DOTFAAAR-0831 Air Traffic Organization Operations Planning Office of Aviation Research and Development Washington DC 20591

Networked Local Area Networks in Aircraft Safety Security and Certification Issues and Initial Acceptance Criteria (Phases 1 and 2) November 2008 Final Report This document is available to the US public through the National Technical Information Service (NTIS) Springfield Virginia 22161

US Department of Transportation Federal Aviation Administration

NOTICE

This document is disseminated under the sponsorship of the US Department of Transportation in the interest of information exchange The United States Government assumes no liability for the contents or use thereof The United States Government does not endorse products or manufacturers Trade or manufacturers names appear herein solely because they are considered essential to the objective of this report This document does not constitute FAA certification policy Consult your local FAA aircraft certification office as to its use This report is available at the Federal Aviation Administration William J Hughes Technical Centerrsquos Full-Text Technical Reports page actlibrarytcfaagov in Adobe Acrobat portable document format (PDF)

Technical Report Documentation Page

1 Report No

DOTFAAAR-0831

2 Government Accession No 3 Recipients Catalog No

4 Title and Subtitle

NETWORKED LOCAL AREA NETWORKS IN AIRCRAFT SAFETY SECURITY AND CERTIFICATION ISSUES AND INITIAL ACCEPTANCE CRITERIA (PHASES 1 AND 2)

5 Report Date November 2008

6 Performing Organization Code

7 Author(s)

Eric Fleischman Randall E Smith and Nick Multari

8 Performing Organization Report No

9 Performing Organization Name and Address

The Boeing Company PO Box 3707 MC 7L-49 Seattle WA 98124-2207

10 Work Unit No (TRAIS)

11 Contract or Grant No

DTFACT-05-C-00003

12 Sponsoring Agency Name and Address

US Department of Transportation Federal Aviation Administration Air Traffic Organization Operations Planning Office of Aviation Research and Development Washington DC 20591

13 Type of Report and Period Covered Final Report December 2004-December 2006

14 Sponsoring Agency Code AIR-120

15 Supplementary Notes

The Federal Aviation Administration Airport and Aircraft Safety RampD Division Technical Monitor was Charles Kilgore 16 Abstract

This report presents the results of the Federal Aviation Administration (FAA) local area network (LAN) research effort addressing potential safety impacts introduced by LANs in aircraft Interconnecting previously isolated components on aircraft increases the complexity of unintended interactions between components and provides potential new access points that could be exploited to cause harm This report addresses the potential security vulnerabilities introduced by networking LANs the safety affects of security failures and a process for designing and certifying LANs on aircraft to ensure the safety of these new aircraft systems This report extends the current FAA safety assurance processes into airborne networked environments by leveraging the Biba Integrity Model It builds upon existing FAA studies that articulate mechanisms to integrate RTCADO-178B and common criteria processes for the National Airspace System This approach creates a safety-oriented airborne networked architecture that is built upon existing DO-178B and Aerospace Recommended Practice 4754 safety mechanisms This produces results that are a direct analog to existing US Department of Defense policies and processes 17 Key Words

Local area network Network Aircraft safety Aircraft security

18 Distribution Statement

This document is available to the US public through the National Technical Information Service (NTIS) Springfield Virginia 22161

19 Security Classif (of this report) Unclassified

20 Security Classif (of this page) Unclassified

21 No of Pages 204

22 Price

Form DOT F 17007 (8-72) Reproduction of completed page authorized

TABLE OF CONTENTS Page EXECUTIVE SUMMARY xiii 1 INTRODUCTION 1

2 OBJECTIVES AND APPROACH 7

21 Notional Networked Aircraft Architecture 9 22 Why Both Target Alternatives Have Similar Security Postures 13

3 EXTENDING THE CURRENT FAA CERTIFICATION ENVIRONMENT 15

4 NETWORK RISKS 19

41 Different Universes Stand-Alone Versus Networked 21 42 Internal External and Client-Side Attacks 24 43 Commerical Off-the-Shelf Vulnerabilities in a Networked Environment 26 44 Mixing Embedded Systems and Generic Operating Systems 31 45 Internet Protocol Family Security 35 46 Network ManagementmdashNetwork Security Concern 43

461 The SNMP has no Provisions for Two-Factored Authentication 44 462 The SNMP Symmetric Keys may be Assembled From Passwords 44 463 The SNMP Key Updates do not Provide for Perfect Forward Secrecy 45 464 The SNMP Symmetric Key Distribution Problems 45 465 The SNMP Currently Lacks Demonstrably Viable Session Keys 46

47 Mixing Different Communication Protocol Systems 46

471 Significant Semantic Differences to Allegedly Similar Concepts 48 472 Integrating Dissimilar Protocol Families 48

48 Identity Problem 50 49 Integrated or Cooperating System of Systems 51

5 NETWORK SECURITY DEFENSES 52

51 Defense-in-Depth 52 52 Department of Defense Networking 55 53 Internet Protocol Topology Hierarchy and Policy Systems 58 54 Mechanisms to Connect Aircraft to Networks 59

541 Aircraft and Network Mobility 60

iii

542 Aircraft as a Node (MIP and MANET) 60 543 Multilevel Network Systems (RED-BLACK VPN) 61

55 Airplane Routing and Autonomous Systems 62 56 Virtual Private Networks Enable Network Partitioning 66 57 Security Zones and Policy-Based Networking 69

6 RELATING SAFETY AND SECURITY FOR CERTIFICATION 73

61 Security Requirements of Airborne Networked Environments 74

611 Integrity 75 612 Availability 77 613 Authentication 78 614 Confidentiality 79 615 Nonrepudiation 79

62 Extending FAA Orders Guidance and Processes Into Vast Network Systems 79 63 Comparing Civilian Aircraft Safety and Federal Government Security Levels 83

631 Civil Aircraft Software Levels 83 632 Federal Government Security Classifications 85 633 Comparison of the Two Policy Systems 86

64 Biba Integrity Model and Bell-LaPadula Confidentiality Model

are Direct Analogs 87

65 Relating Safety Classification Levels to the CC 90 7 EXTENDING FAA CERTIFICATION TO AIRBORNE NETWORKS 93

71 Extending ARP 4754 Into Networked Environments 94 72 Extending DO-178B Into Networked Environments 96

8 CANDIDATE SAFETY AND SECURITY NETWORK SOLUTION 98

81 System Security Engineering Methodology 99 82 Applying the SSE Methodologies to Airborne Networks 102 83 Exemplar Airborne Network Architecture Solution 105

831 The VPN Encapsulation Method 108 832 Physical Security 114 833 Encapsulation Gateways 115 834 Packet Filter 116 835 Firewall 117 836 The ASBR Router 117

iv

837 High-Assurance LAN 118 838 Quality of Service 118 839 Air-to-Ground and Air-to-Air Communications 118

84 Network Management Extensions 119

9 ANSWERS TO THE PHASE 1 QUESTIONS 122

91 Connection of Multiple Domains 122

92 Integrated Modular Avionics Implementation 123

93 Using Public IPs 125

94 Electronic Flight Bags 125

95 Updating Security Protection Software 127

96 Responding to Security Breaches 128

97 Access to Aircraft Data 129

98 Adequacy of Existing Regulations 129

99 Ground-to-Air Communication 130

910 What is the Efficacy of Cyclic Redundancy Checks With Respect to Security 130

10 ANSWERS TO THE PHASE 2 QUESTIONS 131

101 Are Current Regulations Adequate to Address Security Concern 131

102 How Does Security Assurance Fit Into Overall Certification Process 132

103 What Should Network Security Assurance Process Contain to Meet XX1309 132

104 How Will Continued Airworthiness and Maintenance be Addressed 134

105 How Can it be Ensured That Networked Systems Cannot Impact Safety 135

106 What Should the Process be for Updating Security Protection Software 135

107 How can Security Breaches be Handled 136

11 SUMMARY 137

v

111 Findings and Recommendations 139 112 Topics Needing Further Study 147

12 REFERENCES 148

13 RELATED DOCUMENTATION 156

14 GLOSSARY 157

APPENDICES

AmdashHistoric Attack Mechanisms and Tools BmdashFAA LAN Survey Results

vi

LIST OF FIGURES

Figure Page 1 Notional Networked Aircraft Architecture 10 2 Generic Future Communication System Physical Architecture 11 3 Alternative Notional Aircraft Architecture 11 4 Both Target Architectures Have Similar Security Profiles 14 5 Three Different Software Certification Environments 16 6 The FAA Five Layers of System Protection 19 7 Network Threat Mission and Operational Impact 21 8 Airborne Network Threat Targets 21 9 Threat Agents in a Networked Environment 26 10 A Sample Deployment 30 11 Comparison Between the OSI and TCPIP Protocol Stacks 46 12 Transforming Islands of Communication Into a Single Logical Network Infrastructure 49 13 Internet Protocol Stack to Convey Legacy Protocols 50 14 Overlapping Defense-in-Depth IA Systems 53 15 Sample Defense-in-Depth Technologies 54 16 Control Life Cycle 55 17 The DoD COMSEC End-to-End Packet Flow (IPV4 Example) 56 18 Representation of how Aircraft may Function Within the GIG 57 19 Internet Protocol Topology Hierarchy 59 20 Interfaces Between Customer and Service Provider Networks 67 21 Example of VPN Encapsulation Using IPsec 68

vii

22 Customerrsquos L3VPN Protocol Stack Shown Within the Network 69 Service Providerrsquos Network 23 Historic PBN Framework 70 24 Code- and Document-Signing Process 76 25 Code- and Document-Signing Verification Process 76 26 Bell-LaPadula Confidentiality and Biba Integrety Models Compared 82 27 DO-178B Classifications Using Biba Integrity Model 89 28 Gap Analysis in the Alves-Foss et al Study 93 29 Security Engineering Process 100 30 Secure Generic Airborne Network Design (High-Level View) 106 31 How Design Addresses Network Risks 107 32 How Design Addresses Network Threats 108 33 Close-Up Detail of How Encapsulation is Accomplished 109 34 VPN Interconnecting Two Sites 110 35 Sample Airborne Network Management 120 36 Notional IMA Design (Example 1) 124 37 Notional IMA Design (Example 2) 124

viii

LIST OF TABLES Table Page 1 Internet Engineering Task Force Protocol Security Features

and Key Management Configuration 36 2 Comparison of Safety Levels to Security Classifications 86

ix

LIST OF ACRONYMS AND ABBREVIATIONS AC Advisory Circulars ACARS Aircraft Communications and Reporting System AFDX Avionics Full-Duplex Switched [Ethernet] AJ Anti-jamming ARP Aerospace Recommended Practice AS Autonomous system ASBR AS boundary router (alternatively AS Border Router) ATN Aeronautical Telecommunications Network BGP Border Gateway Protocol CA Certificate Authority CC Common criteria CE Customer edge CERT Computer Emergency Response Team CFDIU Central fault display information unit CIDR Classless interdomain routing CIM Common information model CIO Chief Information Officer CLNP Connectionless network protocol COMSEC Communications security CONOPS Concept of Operations CONS Connection-oriented network service COPS Common Open Policy Service COTS Commercial off-the-shelf CPU Central processing unit CRC Cyclic redundancy check DAA Designated approving authority DARPA Defense Advanced Research Projects Agency DEN Directory-enabled networking DHCP Dynamic host configuration protocol DMTF Distributed Management Task Force DNS Domain Name System DoD Department of Defense DoDI Department of Defense Instruction DoS Denial of service DSS Digital Signature Standard EAL Evaluation assurance level EFB Electronic flight bag EGP Exterior gateway protocol ESP Encapsulating security payload FAA Federal Aviation Administration FIPS Federal Information Processing Standard FTP File transfer protocol GIG Global information grid HAG High-assurance guard

x

xi

HMAC Hashed Message Authentication Code HTTP Hypertext transfer protocol IA Information assurance IATF Information Assurance Technical Framework ICMP Internet control message protocol IDS Intrusion detection system IETF Internet Engineering Task Force IGP Interior gateway protocol IMA Integrated modular avionics IP Internet protocol IPsec Internet protocol security IPSP Internet protocol security policy ISMS Integrated security model for SNMP ISP Internet service providers IS-IS Intermediate system to intermediate system IT Information technology L2VPN Layer 2 virtual private network L3VPN Layer 3 virtual private network LAN Local area network LDAPv3 Lightweight directory access protocol version 3 LLC Limited Liability Corporation LPILPD Low probability of interceptlow probability of detection MAC Mission assurance category MANET Mobile ad hoc networking MIB Management information base MIP Mobile Internet protocol MOSPF Multicast open shortest path first (protocol) MPLS Multiprotocol label switching MSLS Multiple single levels of security NAS National airspace system NAT Network address translator NEMO Network mobility NFS Network file system NIDS Network intrusion detection system NIST National Institute of Standards and Technology NMS Network management system NSA National Security Agency NTP Network time protocol OMT Onboard maintenance terminal OS Operating system OSI Open system interconnect OSPF Open shortest path first (protocol)

PBN Policy-based networking PC Personal computer PE Provider edge PEP Policy enforcement point PFS Perfect forward secrecy PIB Policy information base PIM-DM Protocol-independent multicast-dense mode PIM-SM Protocol-independent multicast-sparse mode PKI Public key infrastructure PPS Ports protocols and services QoS Quality of service RAM Random access memory RFC Request for comment (ie Publications of the IETF) RPC Remote procedure call RSA Rivest Shamir Addleman RTP Real-time protocol SA Security association SATS Small aircraft transportation system SBU Sensitive but unclassified SLA Service level agreement SMTP Simple mail transfer protocol SNMP Simple network management protocol SPD Security policy database SSE System security engineering SSH Secure shell (protocol) SWAP Size weight and power SYN Synchronous (bit) TCP Transmission control protocol TCSEC Trusted Computer System Evaluation Criteria TFTP Trivial file transfer protocol TLL Time to live TLS Transport layer security TP Transport layer protocol TSIG Secret key transaction authentication for DNS UDP User datagram protocol V Version VPN Virtual private network WAN Wide area network

xii

EXECUTIVE SUMMARY

This is the final report of a 2-year Federal Aviation Administration (FAA)-funded study to address security and safety issues associated with networked airborne local area networks This study consisted of two phases Phase 1 investigated the methodologies for identifying and mitigating potential security risks of onboard networks that could impact safety Phase 2 investigated techniques for mitigating security risks in the certification environment Current FAA safety assurance processes for airborne systems are based on Aerospace Recommended Practice (ARP) 4754 ARP 4761 and Advisory Circulars (AC) (eg AC 251309-1A and AC 231309-1C) FAA software assurance is based on compliance with DO-178B that guides software development processes Complex electronic hardware design assurance is based on RTCADO-254 ARP 4754 extends the DO-178B software assurance process to address the additional safety issues that arise when software is embedded into highly integrated or complex airborne system relationships Connecting airborne software within network systems represents an extension of the ARP 4754 environment to networked items that share limited common functional relationships with each other This is because networks connect entities or components of a system into a common networked system regardless of the original functional intent of the system design (eg multiple aircraft domains can be connected by a common network system) Networks are inherently hostile environments because every network user including both devices (and their software) and humans is a potential threat to that environment Networked entities form a fate-sharing relationship with each other because any compromised network entity can theoretically be used to attack other networked entities or their shared network environment Networked environments and the entities that comprise them need to be protected from three specific classes of threat agents (1) the corrupted or careless insider (2) the hostile outsider and (3) client-side attacks Because of these dangers ARP 4754 needs to be extended for networked environments by ensuring network security protection and functioncomponent availability and integrity This in turn implies the need to strategically deploy information assurance security controls within network airborne systems Safety and security have therefore become intertwined concepts within networked airborne environments Security engineering addresses the potential for failure of security controls caused by malicious actions or other means Safety analysis focuses on the effects of failure modes The two concepts (safety and security) are therefore directly related through failure effects A shortcoming of either a safety process or a security process may cause a failure in a respective system safety or security mechanism with possible safety consequences to the aircraft depending on the specific consequence of that failure Previous studies have sought to address airborne safety and security by correlating DO-178B safety processes with common criteria security processes This correlation produces necessary but inadequate results It is inadequate because it lacks mathematical rigor and therefore produces ad hoc conclusions The results are ad hoc because even when safety and security are correlated they are nevertheless distinct concepts from each other addressing very different concerns

xiii

xiv

This report states that the primary issue impacting network airborne system safety is how to extend existing ARP 4574 ARP 4761 DO-178B and DO-254 assurance guidance processes into networked systems and environments in a mathematically viable manner This study recommends that these processes can be extended into arbitrarily vast network environments in a mathematically viable manner by using the Biba Integrity Model framework This report maps current DO-178B and ARP 4754 processes into the Biba Integrity Model framework using well- established system security engineering processes to define airborne safety requirements It applies best current information assurance techniques upon those airborne safety requirements to create a generic airborne network architecture Since the Biba Integrity Model is an integrity framework it carries within itself a natural mechanism for relating safety and security concepts in terms of their respective integrity attributes Nevertheless this study recommends that the model be implemented solely within the context of existing FAA safety processes This results in airborne network systems being organized into networks that operate at specific safety levels (the DO-178B software levels) There are fortuitous secondary effects from using the Biba Integrity Model to extend current FAA processes into networked environments that stem from it being the direct analog of the Bell-LaPadula Confidentiality Model The Bell-LaPadula Confidentiality Model forms the framework for confidentiality within US Department of Defense (DoD) information processing Consequently the application of the Biba Integrity Model to airborne system assurance processes results in an airborne network architecture that remarkably resembles the emerging DoD network architecture (the global information grid (GIG)) despite their very different underlying goals Consequently the generic airborne network architecture identified by this study greatly resembles the DoDrsquos GIG architecture While military technologies could be used to implement the airborne network architecture this study recommends the use of civilian Internet protocols deployed as a virtual private network In addition the similarities between the Biba Integrity Model and the Bell-LaPadula Confidentiality Models may result in increased synergies between the DoD and FAA certification processes Deploying airborne systems into networked environments means that the FAA system safety assessment (ARP 4761) system development (ARP 4754) software assurance (DO-178B) and complex electronic hardware assurance (DO-254) processes need to be extended to address and mitigate network threats For example although security is primarily a systems concept involving system issues (eg ARP 4754) the Biba Integrity Model relies upon the networked items having integrity attributes that function at a known assurance level (ie specific DO-178B software levels) This means that the processes for developing those items for network environments should be extended to address network attack risks The concept of high-assurance software in networked environments should therefore mean that items and systems will behave in the same manner before during and after network attacks ie be immune to potential network-based threats Exploits in network environments leverage latent software blemishes so that software items are subject to misbehavior corruption or compromise possibly including

use as a launching pad to attack other systems and items Current DO-178B processes do not currently include mechanisms to identify and fix well-known network attack vectors This study identifies specific additional tests to perform that function Unfortunately software testing alone cannot result in high-assurance software This is because tests only identify the flaws for which the tests are designed to identifymdashthey cannot warrantee the absence of other flaws that were not addressed by the test suite There is no existing security theory or process that can be leveraged to produce guaranteed high-assurance results for networked environments This is a very significant certification issue Until a solution for this problem is found this study recommends that the FAA ensure that high-assurance software complies with formal models and undergoes a rigorous line-by-line code inspection to demonstrate a lack of bugs that can be hostilely attacked

xvxvi

1 INTRODUCTION

This is the final report of a 2-year Federal Aviation Administration (FAA)-funded study to address security and safety issues associated with networked airborne local area networks (LAN) This study consisted of two phases Phase 1 investigated the methodologies for identifying and mitigating potential security risks of onboard networks that could impact safety Phase 2 investigated techniques for mitigating security risks in the certification environment Individual systems onboard aircraft are designed to meet specific operational functional and physical requirements The safety requirements of a flight-critical avionics system differ from a cabin management system or a passenger in-flight Internet service If these systems become interconnected incompatibilities in design assumptions administrative policies user interaction and data security considerations increase their exposure to risk Actions taken in the context of an open passenger network (whether originating onboard an airplane or from some remote site via a network connection) must be prevented from introducing flight-safety risks to flight-critical systems Airborne systems are designed built and approved in accordance with airworthiness requirements Current FAA safety assurance processes for airborne systems are based upon Aerospace Recommended Practice (ARP) 4754 [1] ARP 4761 [2] and Advisory Circulars (AC) eg AC 231309-1C [3] and AC 251309-1A [4] FAA software assurance is based on compliance with RTCADO-178B [5] that guides software development processes Complex electronic hardware design assurance is based on RTCADO-254 [6] The primary FAA certification standards are the respective regulations FAA policy and the ACs This study addresses how to extend current FAA processes and certification environment to include networked airborne LANs in a mathematically viable manner Because of the extensive scope of the current FAA policies and processes this report addresses this larger issue by specifically explaining how to extend the software assurance subset Other aspects of FAA policy and processes can be extended into networked environments in a parallel manner (ie by leveraging a security model framework see section 62) DO-178B is one means to secure approval of airborne software The system safety assessment processes (ARP 4754 and ARP 4761) determine failure conditions of the system and define safety-related requirements as input to the software life cycle processes DO-178B identifies the software level of a software item based on the potential contribution of the software to failure conditions for the entity in question Software level refers to the worst-case result of a failure of that software upon aircraft safety in terms of one of five possible failure condition categories The failure condition categories range from failure conditions that would prevent the aircraftrsquos continued safe flight and landing (catastrophic) to failure conditions that do not affect the operational capability of the aircraft nor increase crewrsquos workload (no effect) Higher software levels and greater assurance protections are provided to entities that would have higher safety consequences should they fail DO-178B also addresses some software design and certification considerations for user-modifiable software option-selectable software commercial off-the-shelf (COTS) software and other software-related issues

1

Similar guidance is also provided for airborne electronic hardware (eg DO-254) The principals that pertain to networking airborne systems that are addressed in this report directly pertain to all networked system entities both software and hardware This reportrsquos resulting exemplar network architecture (see section 83) is therefore agnostic concerning whether the airborne networked entities are hardware software or a combination of both Historically many software entities onboard aircraft are embedded in systems performing specialized mission-related functions COTS-generic computing devices are increasingly being deployed within the National Airspace System (NAS) and they are occasionally deployed within aircraft as well1 John Knight [7] identifies two primary reasons for the increased use of general-purpose computing devices and hardware (eg microprocessors random access memory (RAM) and memory management unit) 1 For enhanced avionics functionality Specifically entirely new concepts become

possible with the introduction of digital systems These include modern autopilot technology with greater functionality and flexibility than was possible with historic analog systems modern full authority digital engine controls envelope protection systems and flight deck automation (ldquoglass cockpitrdquo)

2 For enhanced safety Examples include aircraft condition analysis and management

systems structural health monitoring and automatic alerts of potential runway incursions

DO-178B and supporting advisory circulars address all phases of the software development process for all software types to ensure that airborne systems are safe This includes electronic flight bag computing devices [8] These cumulative systems processes and guidelines were historically targeted for aircraft environments whose internal networks are specialized to accomplish specific mission functionality Aircraft devices are historically connected via specialized and sometimes proprietary data buses to other devices with which they perform associated functions The nature of these connections is tailored to support their specific communication requirements (eg deterministic real time asynchronous etc) Air-to-ground communication similarly occurs via special-purpose communication systems using special-purpose data communication protocols Visionaries anticipate forces that could motivate future airborne system designs to replace todayrsquos diverse data bus systems within aircraft including many of their current constraints (eg access point limitations proprietary protocols labeling and mitigations such as cyclic redundancy checks) with airplane-appropriate LAN technologies that support standard Internet

1 COTS software components are very rare critical airborne systems and are discouraged from being deployed in

those environments because they cannot comply with DO-178B and other software policy in general

2

protocol (IP)-based communications For example reference 9 concluded that Ethernet-based LANs could be appropriate to serve as aviation data buses if they use

ldquoa switched Ethernet topology along with traffic regulation bandwidth restriction (guarantee and control of bandwidth allocation) and call admission controlrdquo

Coupled with the linkage of aircraft systems via a common network system is a growing perception of the desirability to improve and enhance air-to-ground and air-to-air communication systems and processes as well as to more closely integrate airborne systems with NAS systems For example bull Integrating multiple data bus systems into onboard LAN(s) is expected to reduce aircraft

size weight and power (SWAP) overheads thereby improving aircraft flight performance parameters

bull Next generation aircraft display systems may want to combine map and air traffic data

terrain information weather radar returns information on man-made obstacles and imagery on the airport environment This would require fusing data from sources that are not currently associated together It would also necessitate the support of high-bandwidth data communications internally within the aircraft as well as air-to-ground and within the NAS

bull National Aeronautics and Space Administration Small Aircraft Transportation System

(SATS) is investigating mechanisms that would enable small aircraft to fly to and from the 5400 small airports that are not currently being used for reliable public transportation ldquoA key to implanting SATS is a robust and extremely reliable automated communications system The system must be capable of passing large amounts of data between aircraft and ground systems as well as between neighboring aircraft in a reliable mannerrdquo [10]

bull George Donohue former FAA Associate Administrator of Research and Acquisition has

expressed concerns that the United Statesrsquo

ldquoair transportation network is seriously overloaded in the major cities that support airline hub operations hellip This hellip is leading to a gradual decrease in the US air transportation system safety hellip There is a growing consensus over the last 3 years that the capacity of the US National Airspace System is finite and currently approaching critical saturation limits hellip Without new technology and operational procedures we cannot increase capacity without decreasing the systems safety hellip Without increased capacity the increased cost of air transportation will effectively suppress demand (for new aircraft domestic tourism international travel etc) and have a profound effect on the nationrsquos culture and economy hellip System maximum capacity is very sensitive to aircraft final approach spacing Decreasing aircraft separation in the final approach to a runway from an average of 4 nautical miles between aircraft to 3 nautical miles

3

would increase this capacity in the USA [from the current 30 million operations per year] to over 40 million operations per year hellip [To accomplish this] all commercial aircraft will need to have double to triple redundant collision detection and avoidance systems on the aircraft with professionally trained pilots providing safe aircraft separation The national air traffic control system should be distributed between ground and airborne systems in such a way that it will be almost immune to single point failureshelliprdquo [11]

bull Arguments that the air traffic management system should become network centric to

ultimately achieve the NAS goals Dennis Buede John Farr Robert Powell and Dinesh Verma define a network centric-system as

- ldquoA network of knowledgeable nodes shares a common operating picture

and cooperates in a shared common environment - Functional nodes reside in the cognitive physical and information

domains and communicate with each other and between domains - The heart of the system is the network Knowledgeable nodes may act

autonomously (self-synchronization) with or without a central command and control facility The US Federal Aviation Administration (FAA) refers to the National Airspace System (NAS) which is made up of more than 18300 airports 21 air route traffic control centers (ARTCC) 197 terminal radar approach control (TRACON) facilities over 460 airport traffic control towers (ATCT) 75 flight service stations and approximately 4500 air navigation facilities The airlines and government employ more than 616000 active pilots operating over 280000 commercial regional general aviation and military aircraft hellip

hellip The current improvements to the NAS focus on safety accessibility flexibility predictability capacity efficiency and securityrdquo [12]

bull Evolving airborne software systems to similarly support network centric operations promises enhanced automated aircraft system update procedures and maintenance processes that are not possible with todayrsquos federated systems

The proposed transformation of todayrsquos aircraft and airspace system can be compared to the rapid increase in interoperability seen in commercial and military systems These previous revolutions similarly capitalized on explosive increases in computing power and interconnectivity as well as rapidly evolving protocols and services This rapid rate of change combined with a lack of discipline among commercial vendors who prized functionality over security unfortunately has resulted in a landscape where secure interconnected systems rarely (if ever) exist The anticipated deployment of networked LANs in aircraft is therefore not an isolated event It is a constituent element within the larger network centric evolution of society The implications

4

of linking aircraft-resident systems over a common data bus needs to be considered within the larger context of the network-centric evolution of air-to-air air-to-ground and ground-to-ground communications within the airspace as a whole However with these advantages come risks associated with increased exposure of previously isolated components Aircraft vendors operators and regulators need to understand the impact that interconnected systems may have upon flight safety Design test validation and verification techniques should consider the impact of unanticipated interactions between previously isolated systems In addition the effects of intentional failures caused by malicious software or persons need to be considered Existing evaluation techniques where individual systems have been evaluated in isolation should be updated to address safety concerns introduced by future interconnected systems FAA Order 137082 ldquoInformation Systems Security Programrdquo requires ldquothe FAA must ensure that all information systems are protected from threats to integrity availability and confidentialityrdquo [13] Section 41 of this report explains that networks potentially expose software to larger populations of attack threats As John Knight explains ldquounless a system is entirely self contained any external digital interface represents an opportunity for an adversary to attack the systemrdquo [7] Section 44 explains that COTS computing devices when deployed within networked environments have an indeterminate number of latent security vulnerabilities that can be attacked and potentially exploited COTS systems therefore have very questionable assurance characteristics in networked environments Even though aircraft may not deploy COTS software within their airborne LANs they nevertheless can benefit from the extensive experience gained to date from deploying COTS systems within networks and they may communicate with ground-based networks that widely deploy COTS systems Airborne software and devices unless they have been specifically assured for use in networked environments may or may not manifest similar problems depending on the number and type of bugs present in networked airborne software This is because latent security vulnerabilities when combined with the increased exposure of networked systems can result in security problems that have direct safety implications Vulnerabilities include bull Modification or replacement of authentic aviation software by an alternative variant

introduced by an attacker For example if an attacker could thwart onboard security procedures to download corrupted software of their own choosing then a safety hazard can arise if that corrupted software for example causes the pilotsmdashand the navigation systems they rely uponmdashto believe that their current altitude is 2000 feet higher than it actually is

bull Attacks to network system elements that either hinder correct software operation or else

modify the reported results of correct software operation For example if an attacker takes control of an onboard device and uses it to continuously flood the onboard network with spurious transmissions a safety hazard may arise should that denial of service attack on the network actually succeed in disrupting latency-sensitive real-time transmissions between distributed avionics components and by so doing induce incorrect computation results that affect critical onboard systems

5

Protections against these types of safety threats are primarily accomplished by means of deploying effective information assurance (IA) security controls Safety and security have therefore become intertwined concepts within networked airborne environments Security engineering addresses the potential for failure of security controls caused by malicious actions or other means Safety analysis focuses on the affects of failure modes The two concepts (safety and security) are therefore directly related through failure effects A shortcoming of either a safety process or a security process may cause a failure in a respective safety or security mechanism with possible safety consequences to the aircraft depending on the specific consequence of that failure This study deals with the security and safety issues and acceptance criteria of networked LANs in aircraft In view of the discussion above this study cannot merely evaluate the safety and security implications of introducing LANs to aircraft in an isolated manner Rather the system-wide consequences associated with these changes must be evaluated At a minimum this comprises two distinct but related concepts bull The security and safety issues including acceptance criteria of linking aircraft-resident

systems upon a common network infrastructure This common data bus causes those systems to no longer be physically isolated from each other Rather it links them into a common communications system A direct consequence of this change is that formerly isolated onboard software systems have become theoretically accessible via a common onboard communications system This common onboard communication system is also connected to the aircraftrsquos air-to-ground communication system

bull As described in the bullets shown on pages 3 and 4 anticipated network-centric changes

to the NAS itself results in NAS systems being increasingly redefined into network-centric systems This includes the possibility of aircraft systems being accessible from expanding regions of the NAS Should the NAS itself become connected to public data communications systems such as the Internet then this would result in the theoretical possibility of aircraft being accessible from systems outside of the NAS Specifically should the NAS become connected to the Internet the theoretical possibility exists of accessing aircraft from any location worldwide

By combining these two concepts the net result is the theoretical possibility that specific aircraft-resident systems may become accessible from any location worldwide This possibility has potentially severe safety assurance implications However similar risks result even when no entities using aircraft LANs are involved in communications with entities outside of the aircraft This is because attackers do not need to access aircraft-resident systems to launch electronic attacks upon aircraftmdashsimilar affects can be achieved solely by attacking ground-resident NAS elements For example

ldquoOne of the most frightening images of cyber terrorism is a scenario in which terrorists take over the air traffic control system and cause an aircraft to crash or two planes to collide in flight

6

Industry and governments are extremely sensitive even to the appearance of threats and vulnerabilities A collapse of public confidence in civil aviation safety and a failure to manage public expectation may have serious and widespread economic and social consequencesrdquo [14]

These affects may be similar to the events following the terrorist attacks on September 11 2001 Ken Birman has noted that parallel network-centric evolutions are widespread throughout our society He warns that

ldquoWersquore poised to put air-traffic control banking military command-and-control electronic medical records and other vital systems into the hands of a profoundly insecure untrustworthy platform cobbled together from complex legacy software componentsrdquo [15]

The potential scale of harm from a successful electronic attack against elements within a network-centric NAS system including network-connected aircraft is huge Adversaries may be anonymous and range from individual recreational hackers to well-financed criminal enterprises to well-organized state-led initiatives To the extent that the NAS builds upon COTS technologies the technology employed for electronic attacks will be simple cheap and widely available Reliance upon advances in COTS technology creates an extremely fluid threat environment as historic security vulnerabilities are addressed and new vulnerabilities discovered [16] Fortunately lessons from industry (civilian) and military security processes and experience can be applied to the aviation industry This report therefore examines the safety and security issues introduced by networked LANs on aircraft It seeks to adapt industryrsquos best system security engineering (SSE) practices to identify safety risks caused by aircraft networks It identifies potential security threats and assesses evaluation criteria It leverages best current industry and military practices It proposes specific extensions to ARP 4751 and DO-178B processes to address network security threats and certification issues that arise from networking airborne systems 2 OBJECTIVES AND APPROACH

The purpose of this report is to document evaluation criteria that can be used by certification authorities and industry to ensure that onboard networks will not negatively impact aircraft safety The results will be used by the FAA as input for development of policy guidance and regulations This work is divided into two phases The first phase focused on the potential security risks of onboard networks that affect safety and explored issues and solutions to critical questions raised by the aviation industry as manufacturers consider using LANs in aircraft Initial acceptance criteria for certifying aircraft that use LANs is provided to help evaluators understand the safety and security issues and specific evidence needed to show that proposed designs and countermeasures are sufficient to ensure safety of flight

7

This document also includes the studyrsquos phase 2 effort The phase 2 effort refines the phase 1 results to create specific recommendations to certifiers for the evaluation of the security and safety posture of airplane architectures which include both onboard and offboard networking capabilities Phase 2 also attempts to complete the acceptance criteria started in phase 1 It provides guidelines to help evaluators understand the safety and security issues with networks on airplanes and recommends specific evidence needed to ensure that proposed designs and countermeasures are sufficient to ensure safety of flight This report seeks to answer questions raised by the potential use of LANs on aircraft including bull Are current regulations adequate to address networked airborne security concerns bull How does security assurance fit into the overall certification process including ties to

safety assessment bull What should a network security assurance process contain to enable onboard networks to

meet Title 14 Code of Federal Aviation Part XX1309 [Where XX refers to the particular CFR Part (Parts 23 25 27 29 or 33)]

bull How will continued airworthiness be addressed for onboard networks and how will

regular maintenance be performed in the certification environment bull How can it be ensured that the systems connected to the onboard network cannot

negatively impact safety bull What should the process be for updating security protection software bull How can security breaches be handled Consequently this project bull investigates safety and security issues introduced by using LANs on aircraft bull investigates the potential security risks of an onboard network that could impact safety bull investigates the means for mitigating the security risks in the certification environment bull provides recommendations for assessing safety effects caused by potential security

failures bull provides recommendations for certification of LANs on aircraft

8

21 NOTIONAL NETWORKED AIRCRAFT ARCHITECTURE

Networking aircraft with the NAS is symptomatic of larger societal changes that are arising from the emergence of the worldwide Internet network of networks The Internet has had a profound impact upon many aspects of modern life Many businesses have redefined their relationships with other businesses increasingly basing them upon Internet-oriented electronic commerce technologies The public has also embraced the Internet as witnessed by the growing ubiquity of Internet services such as the worldwide web instant messaging and electronic mail within popular culture Perhaps because of this many aircraft manufacturers are planning to install onboard networks enabling passenger access to the Internet However if an aircraft manufacturer opts to have an onboard network that is available to both passengers and avionics equipment (ie a shared LAN) aircraft safety and security concerns arise As previously mentioned in the introduction parallel evolutionary changes to the NAS increasingly are being proposed that rely upon greater integration between air-based and ground-based airspace systems For example the operational integration of aircraft with the NASrsquo communication and logistics infrastructure promises dramatic improvements in operational efficiency Thus a variety of motivations are increasing the connectivity of aircraft systems to air-based and ground-based network infrastructures Current commercial aircraft systems and networks can be grouped in three major categories closed private and public The closed networks are representative of safety-critical avionics systems private systems represent airline operational systems cabin management systems etc open systems are represented by public Internet services offered to passengers Several changes have been proposed for next generation of aircraft due to the use of local area networking technologies In response to these proposed changes some projects have been initiated in which the common onboard network is designed with partitioning protections The assured robustness of the proposed partitioning is a concern from both a security and safety perspective Previous avionics systems have had their own data bus and have not been accessible by nonavionics systems Security has historically been enforced by a total lack of access (ie an air gap) between systems However as this paradigm changes to support common networked systems the safety and security aspects of the onboard network must be addressed by identifying the resulting risks and establishing appropriate controls to mitigate those risks Several notional views of the current and future aircraft networked systems have been formulated Figure 1 shows one of those views In figure 1 the current (existing) architecture is shown on the left side a logical picture of the proposed target architecture is in the middle and a list of changes to achieve the target (future) architecture is enumerated on the right As previously mentioned a key feature of the existing architecture is its air gap between airborne functions and passenger Internet services Thus there is no way a passenger or entities within

9

the worldwide Internet infrastructure can currently access airborne functions This proposed target architecture alternative by contrast has made three very significant modifications to the current airplane design bull It has created a network within the aircraft itself that supports communications using the

IP protocol family (see section 45) This implies that aircraft control entities logically share a common network infrastructure that is also connected to the nonessential IP network Consequently aircraft control entities are now theoretically connected to nonessential network entities

bull The passenger Internet services have now been connected to the nonessential IP network

This means that all entities within the aircraft will be theoretically connected within the same network system

bull The nonessential worldwide IP network is now connected to NAS and airline ground

systems and the Internet Specifically aircraft control elements are shown to be in the same network system that includes the NAS entities with which they may need to communicate as well as more than one billion people worldwide with Internet connectivity today

Aircraft Control

Airline GroundSystems amp Internet

Non-IP communicationinterface

IP communicationinterface

Existing

PassengerInternetServices

Airborne EquipmentAirborne Equipment

Aircraft Control(containing anIP Network)

Airline GroundSystems amp Internet

Floppy

Non-IP commun-ication interface

IP communicationinterface

Airline GroundSystems amp Internet

Aircraft Control(possibly containing

an IP Network)

Non-essential

IPnetwork

Non-essential

IPnetwork

PassengerInternetServices

Proposed Target

Primary differences in proposed target environment1 Aircraft shares a common

Internet protocol (IP)-based network system

2 Passenger Services AircraftControl and Airline InformationServices share a common network system

3 Specific Aircraft Control andAirline Information Services processes form distributed network relationships with NAS ground computers and potentially other aircraft

Difference1

Difference2

Difference3

Figure 1 Notional Networked Aircraft Architecture

The FAA (ACB-250) community has provided a generic future communication system physical architecture proposal taken directly from reference 17 and is shown in figure 2 which provides greater detail about the network links of the figure 1 target alternative

10

Controller

Aircraftoperator

ATC Voice

ATC Data

AOCAAC Data

Public Internet

Control Site

ControlSite

Equipment

MMC

Technicians

MMC

Technicians

Remote Site

RemoteSite

Equipment

Avionics

Aircraft Pilots

Crew

Passengers

AvionicsAvionics

Aircraft Pilots

Crew

Passengers

Avionics

Aircraft Pilots

Crew

Passengers

AvionicsAvionics

Aircraft Pilots

Crew

Passengers

H

G

G

F

E

Other Control Sites

A

B

C

D

AAC = Airline Administration Communication ATC = Air Traffic Control

AOC = Airline Operational Communication MMC = Maintenance monitor and control

Figure 2 Generic Future Communication System Physical Architecture [17]

Advocates have identified undesirable security implications with the approach shown in figure 1 related to potentially exposing avionics systems to passenger devices and systems These advocates argue that the advantages achieved by removing the historic security air gap between avionics and passenger systems cannot justify the increased risk to avionic systems posed by that connectivity Consequently they have identified an alternative target architecture which is shown in figure 3

Primary differences in proposed target environment1 Aircraft Control and

Airline InformationServices share a common network system

2 Specific Aircraft Control andAirline Information Services processes form distributed network relationships with NAS ground computers byusing an IP-based air-to-groundlink

However the air gap between the Aircraft passengers and the avionics systems remains in tact

Aircraft Control

Airline GroundSystems amp Internet

Non-IP communicationinterface

IP communicationinterface

Existing

PassengerInternetServices

Airborne EquipmentAirborne Equipment

Aircraft Control(containing anIP Network)

Airline GroundSystems amp Internet

Floppy

Non-IP commun-ication interface

IP communicationinterface

Airline GroundSystems

Aircraft Control(possibly containing

an IP Network)

Non-essential

IPnetwork

Non-essential

IPnetwork

PassengerInternetServices

Proposed Target

Internet

Difference1

Difference2

Figure 3 Alternative Notional Aircraft Architecture

11

While there are strong motivations (see section 1) arguing for the migration indicated in either figure 1 or figure 3 to take place there are security and safety reasons for why the current airborne architecture should not change Specifically the existing system is safer and more secure than either of the target systems Section 4 explains some of the reasons why the proposed changes that form the target designs result in significantly more risk to aircraft A summary of these reasons include the following bull The larger the networked community of devices the larger the potential number of

threats to the entities within those networks due to (1) direct or indirect relationships between the networked entities themselves and (2) the increased possibility of hostile attackers being present within the system

bull Due to the emergence of client-side attacks and other threats the (human) end users of

networked resources are now an important part of that networkrsquos total security defense posture Aircraft have limited control over the computer and network behavior of their Internet-connected passengers NAS employees as well as aircraft crew members must be trained to ensure that their own computer behavior does not inadvertently enable attacks against the aircraft This has direct security implications to both the airborne systems themselves as well as to those networks with which the aircraft connects

bull Entities within networks that are directly or indirectly connected to the Internet may

possibly be accessible by attackers located elsewhere in the Internet despite the presence of intervening security firewalls This implies that more than one billion people may (theoretically) potentially have access to aircraft

bull The Internet has experienced many well-documented instances of hostile attacks

affecting the integrity of computers networked systems and the data and services they support

bull COTS computer systems have an indeterminate number of latent bugs that can be

attacked bull COTS computer systems cannot be adequately secured within large network

environments in general because their security controls cannot be trusted to perform as intended when attacked They represent possible footholds that attackers can compromise and use as a base from which to attack other networked entities

bull Security vulnerabilities including those stemming from deploying COTS devices or

systems can theoretically be mitigated However the viability of those mitigation approaches are themselves suspect to the extent that they rely upon COTS systems for their implementation This is because COTS software and systemsmdashand the functionality they supportmdashare not trustworthy when attacked

12

bull The security viability of current networked systems is partially a direct function of the network and system management (including configuration management) expertise of its administrative personnel

bull The protocols of the IP family can be secured but their cumulative underlying key management system is ad hoc and complexmdashwith direct configuration and management implications

bull The IP familyrsquos network management system including its underlying simple network

management protocol version 3 (SNMPv3) protocol has questionable security viability when used in network environments that have large numbers of devices built by many different vendors

bull Whenever different security administrations or technologies are joined together in a

cooperative manner (eg aircraft and ground systems) it is important and challenging to define the interfaces between the systems in such a way that a diminished security posture for the combined system as a whole does not result

This report describes assurance mechanisms to mitigate these threats However the mitigation system has one key missing element (see section 72) Until that element has been successfully addressed no networked system can currently be guaranteed to be as safe or as secure as the currently deployed non-networked airborne systems 22 WHY BOTH TARGET ALTERNATIVES HAVE SIMILAR SECURITY POSTURES

It was mentioned that the architecture in figure 3 is more secure than the architecture in figure 1 However both alternatives have similar security postures such that the same network solution which is described in section 83 addresses the security and safety requirements for both target alternatives Figure 4 shows that both target alternatives similarly expose onboard aircraft systems to possible attacks from the worldwide Internet infrastructure for the reasons explained in section 41 While the air gap between passenger and avionics equipment of figure 3 (see bottom of figure 4) protects avionics systems from being directly attacked intra-aircraft from the passenger network they are still theoretically exposed to remote passenger or Internet attack via the NAS

13

Aircraft

World wide Internet Infrastructure

Air Gap in Aircraft Alternative No Air Gap in Aircraft Alternative

ControSit

NAS Both target approaches are - based threatsexposed to Internet

Second approach is somewhatmore secure than the first buthas greater size weight andpower (SWAP) requirements

Risk mitigation controls are very similar for both targets

Both targets use the same proposed target network architecture design Aircraft

Worldwide Internet InfrastructureAir Gap physically separates passenger communications from avionicscrew communications

avionic

passengers

NAS

Figure 4 Both Target Architectures Have Similar Security Profiles

Consequently the primary advantage of the target approach shown in figure 3 versus the target approach shown in figure 1 is that the figure 3 approach enables the port 80 (ie hypertext transfer protocol (HTTP)) overt channel to be closed within the aircraftrsquos perimeter defense firewall (see section 835) thereby eliminating a vulnerability by which firewall protections can be circumvented There are also two helpful secondary affects of the figure 3 approach bull The packet filter design (see section 834) is simplified Passenger communications of

the figure 3 approach do not traverse avionics networks Consequently the avionics network of that approach does not require that the packet filter system protect it by enforcing quality of service (QoS) provisions upon passenger communications to ensure that those communications do not consume too much avionics LAN capacity Similarly the packet filter would no longer need to ensure that passengers cannot address the encapsulation gateways (see section 833) or the cockpit (pilot) network since there would be no connectivity to those systems However the figure 3 approach still requires that the packet filter be retained to ensure that the noncockpit crew network cannot send packets to the encapsulating gateways unless those crew systems could be provided with physical security guarantees that they are never accessible to passengers

bull The high-assurance LAN (see section 837) is similarly simplified because it no longer

must be deployed in a manner to ensure that the passenger network can only access other avionics systems by means of the packet filter Rather different physical LAN systems must be used by the passenger system and the rest of the aircraft

Consequently the figure 3 approach does not eliminate the need to deploy a packet filter within the aircraft but it does simplify what that packet filter system does However the figure 3

14

alternative requires that parallel (ie distinct) sets of onboard networks and wireless external communications systems be created one for passengers and one for the other aircraft systems The figure 3 approach therefore has a higher SWAP overhead than the figure 1 approach by requiring parallel internal (onboard LAN) and external network (radio satellite etc) connectivity without significantly improving the security profile for the aircraft itself 3 EXTENDING THE CURRENT FAA CERTIFICATION ENVIRONMENT

The purpose of this section is to provide an orientation for how this study recommends that the certification environment be extended to handle networked airborne LANs The specific theory rationale and process underlying this studyrsquos recommendations are explained in subsequent sections (ie sections 6 7 and 8) It was previously mentioned that current FAA and civil aviation safety assurance processes for airborne systems are based on ARP 4754 ARP 4761 and the ACs FAA software assurance is based on compliance with DO-178B and complex electronic hardware design assurance is based on DO-254 The primary FAA certification standards are the respective regulations FAA policy and the ACs This study addresses how to extend these processes and certification environment to include networked airborne LANs in a mathematically viable manner Because of the large scope of the current FAA policies and processes this report addresses this larger task by explaining how to specifically extend its airborne software assurance subset Figure 5 shows a simplified and abstracted view of the current FAA software assurance approval process It shows that airborne software is currently developed and approved primarily according to the guidance and processes described within DO-178B2 When individual software items are combined into integrated or complex systems then additional safety considerations apply which are documented in ARP 4754 These considerations address integration issues and system vulnerabilities that may arise from system dependencies ARP 4754 refers to each element within that system as being an item This same terminology is adopted by this study DO-178B builds upon system design concepts such as the AC 251309-1A fail safe design concepts one of which is integrity Both DO-178B and ARP 4754 (ie section 222 of DO-178B where it is called the ldquosoftware level definitionsrdquo and Table 3 of ARP 4754) rely upon the same five failure condition categories Indeed the same failure condition categories are consistently used within other civil aviation documents as well (eg Table 2-1 of DO-254 and Table 1 of ARP 4761) Different development processes are applied to items classified in different failure condition categories so that items classified in the more severe safety failure conditions are developed by more extensive processes that produce higher assurance results For software items this is reflected in the DO-178B software level definitions For this reason this report refers to DO-178B software levels as reflecting safety assurance levels

2 There are other applicable policies and guidance in addition to DO-178B that can also be applied Please recall

that this figure is a simplified abstraction

15

Stand-alone Software System

ComplexSoftware

ComplexSoftware

ComplexSoftware

1) Stand alone software systemFocuses on that software entity (DO-178B)

2) Integrated or Complex SystemsAddresses each software Item (DO-178B) as well as the potentially complex affects resulting from their integration together (ARP 4754)

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

3) Networked Airborne LANsA complex system in which every entity in the same network (ie the LAN and whatever the LAN directly or indirectly connects to) is inadvertently integrated togetherregardless of the functional intent of the system design

Processes must now also address possible networkinteractions during (and resulting from) network attacks

Fate sharing any compromised network entity can theoretically be used to attack other networked entities or their shared network environment

Other connectedLANs andNetworks

Finite Number of Entities Concerned with effective integration techniques

Concerned with fate sharing in a hostile environmentArbitrarily Huge Number of Entities

Figure 5 Three Different Software Certification Environments

ARP 4754 is directly concerned with architectural considerations that pertain to highly integrated or complex airborne systems

ldquoSystem architectural features such as redundancy monitoring or partitioning may be used to eliminate or contain the degree to which an item contributes to a specific failure condition System architecture may reduce the complexity of the various items and their interfaces and thereby allow simplification or reduction of the necessary assurance activity If architectural means are employed in a manner that permits a lower assurance level for an item within the architecture substantiation of that architecture design should be carried out at the assurance level appropriate to the top-level hazard hellip It should be noted that architectural dissimilarity impacts both integrity and availability Since an increase in integrity may be associated with a reduction in availability and vice-versa the specific application should be analyzed from both perspectives to ensure its suitabilityrdquo (Quoted from Section 541 pages 25 and 26 of reference 1)

Because ARP 4754 addresses possible system vulnerabilities that derived from creating functional system relationships between items to a certain degree it can be characterized as being directly concerned with effective integration techniques between those system items It therefore presumes that the regulator can correctly identify the items that comprise a system as well as their mutual relationships together

16

Aircraft network security is a systems issue System development (ARP 4754) in conjunction with the system safety assessment process (ARP 4761) is responsible for defining network accesses vulnerabilities detection and protection requirements Some of the vulnerabilities will be mitigated by limiting and controlling access by using hardware and software capabilities Some identified vulnerabilities will be mitigated by monitoring and detection capabilities The security protection should be defined by the system and then by appropriate system requirements allocated to hardware software and hybrids This study assumes that best current IA practice will be followed including deployment of traditional IA security controls when appropriate After implementation these protections mitigations and monitoring will also likely be verified and validated at the system level as well Consequently aircraft network security is an ARP 4754 issue However approving networked systems in some ways should be recognized as being a significant extension to ARP 4754 Networked systems differ from the current ARP 4754 environment in several significant ways Networked elements are systems that include all of the networks and their constituent elements and users to which the network is directly or indirectly attached Networks are therefore arbitrarily huge and the many interrelationships of the system items are often too subtle to discern Networks are inherently complex systems in which every item in the network is inadvertently integrated regardless of whether those items share any common functional goal Approval of networked entities must now also address possible network interactions that occur during and result from network attacks The various networked elements potentially have a fate sharing relationship with each other because any compromised network entity theoretically can be used to attack other networked items or their shared network environment Therefore networked airborne LAN environments are inherently ldquohighly integrated or complex aircraft systemsrdquo with attributes that extend the complex relationships for which ARP 4754 was created Section 4 and appendix A will introduce some of the risks that characterize networked systems and underlie the following observations bull In networked environments ARP 4754 needs to be extended to consider each item within

the LAN to be integrated even if that item has no functional relationship with anything else For example

- If the LAN experiences a successful denial of service (DoS) attack then each

networked item in that LAN may potentially be unable to fulfill its function Therefore ARP 4754 must be extended in networked environments to ensure availability

- If an item in the LAN becomes hostilely compromised by an attacker then it

potentially can be used by that attacker to attack the network itself or other items on the LAN Therefore ARP 4754 must be extended in networked environments to address LAN and item integrity To ensure LAN and item integrity ARP 4754 needs to be extended to require verifiably secure software installation procedures as well as mechanisms to ensure the continued integrity of deployed items and systems

17

bull If airborne LANs are connected into networks then the cumulative network system has

similarly become integrated and existing safety processes need to become extended to each system and item within that larger networked system if they are to remain viable even if any component element within the larger system never itself becomes airborne

bull If the network has both device and human users then ARP 4754 must also become

extended to also pertain to humans Every human or device with access to that network is a potential threat to that network and may potentially initiate attacks against the network itself the LANs or subnetworks that comprise that network of the items located within that network If the network is directly or indirectly connected to the Internet then there are theoretically more than one billion humans with potential access to that airborne LANmdashdespite the presence of intermediate firewalls This means that mechanisms are needed within networked systems so that human behavior cannot deprecate historic DO-178B and ARP 4754 safety assurances

This study identifies mechanisms by which ARP 4754 can be extended to address networking requirements by strategically introducing integrity and availability security controls It does this by building upon a mathematically based security model that can extend ARP 4754 concepts into arbitrarily vast and complex network systems This study uses proven SSE processes to combine these concepts and controls into the exemplar network architecture (see section 8) This study is also similarly concerned with extending DO-178B so that highly assured software items within networked environments can be developed and assured to mitigate known network risks The concept of highly assured software in networked environments explicitly means that the software can be trusted to behave in the same fashion before during and after attacksmdashsomething that current DO-178B processes cannot ensure because they do not explicitly address network attack threats Consequently current DO-178B software in networked environments may behave in an indeterminate manner during or after attacks if latent bugs within the software itself are successfully attacked by exploits that violate its integrity Such software is a potential threat to its deployment environment It is potentially subject to misbehavior corruption or compromise potentially including becoming used as a launching pad to attack other systems and items This issue is addressed in section 72 This study does not provide suggestions for the process by which the FAA or the worldwide civil aviation community may choose to respond to these recommendations It may be that the relevant experts may conclude that the revision of ARP 4754 and DO-178B that this study presumes is an unacceptably long term or unreliable approach for ensuring that network security concerns are adequately addressed in a timely manner If so then it is conceivable that the FAA may decide to produce an airborne network system security assurance policy in the near term If this is done then if SAE and RTCAEUROCAE subsequently decide to address this issue in the future then that initial policy could be revised to reflect their proposal

18

4 NETWORK RISKS

This section specifically discusses network security issues that are directly relevant to airborne safety and security within networked environments Two papers authored by Daniel Mehan [18 and 19] the former FAA Chief Information Officer (CIO) provide an important context for the material discussed in this section These papers describe the cumulative processes needed to create a secure and safe NAS environment These processes are partially summarized in figure 6 The majority of the topics covered in this section directly focus on network system aspects of ldquoCyber Hardening of System and Network Elementsrdquo shown in figure 6 of a total protection system Many other aspects of NAS safety and security are not addressed within this section and are only briefly addressed by this study

PersonnelSecurity

PhysicalSecurity

Cyber Hardening ofSystem and Network Elements

Compartmentalization

RedundancyArch

itectu

re a

nd E

ngine

ering

Awareness and Execution

Figure 6 The FAA Five Layers of System Protection [18]

Reference 20 also provides very helpful concepts and background information for the aircraft network safety and security topics presented in this section and appendix A It is important to recognize that network threats are always evolving An indeterminate number of network threats exist These network threats can mutate quite rapidly For example the following is an example of a current network threat that did not exist the year before this study was written

ldquoFile encrypting Trojans are becoming so complex that security companies could soon be powerless to reverse their effects a new report from Kaspersky Lab said

19

The report notes the rapid evolution of the public key encryption used by one family of crypto malware Gpcode which went from using 56-bit to 660-bit RSA [encryption key] in a matter of weeks Commonly termed lsquoransomwarersquo Trojans that encrypt data files on a userrsquos [personal computer] PC before demanding a payment in return for supplying the key to unlock the files have come from nowhere in recent months to become a measurable problem At the time of its discovery in June [2006] Gpcodeag ndash which used a formidable 660-bit key ndash Kaspersky described the process required to decrypt such a key as equivalent to setting a 22 GHz PC to work for thirty yearsrdquo (Quoted from reference 21)

Defenses that require a response to each new threat instance as it appears are both expensive and of questionable efficacy The best mechanism to effectively constrain the impact of these threats over time is to create a very solid safety and security foundation for both the NAS and aircraft Figures 7 and 8 were created by David Robinson [22] to indicate the possible threat affects that can occur when networked aircraft becomes successfully attacked These types of threats cannot occur for aircraft whose aviation systems are not attached to network systems

ldquoThese new generation aircraft [eg B787 A370 A350 BY-1] will include a new aircraft data network design which will introduce new cyber security vulnerabilities to the aircraftrdquo [22]

Unless properly mitigated any networked aviation system is potentially subject to the following range of impacts should they be successfully attacked

20

General Threat

Identifiers Aircraft Data Network Threats

Aviation Infrastructure Mission and Operational

Impact FAILURE Safe state of the aircraft system could

be compromised in the event of a security penetration

Access to the flight controls by unauthorized individuals affecting safety

DENIAL Aircraft system resources exhausted due to denial of service attack system error malicious actions

Critical services disrupted by system overload or traffic jamming

Access Control

Individual other than an authorized user may gain access to the aircraft system via phantom controller masquerade or spoofing system error or an attack for malicious purposes

Unauthorized Access

Passive Attack

Snooping or eavesdropping compromising security (misdirection) Design Flaws may lead to back door access

Unauthorized corruption or destruction of data causing unsafe flight conditions

Figure 7 Network Threat Mission and Operational Impact [22]

Threat Targets Threat Effects

Aircraft Operation Serious degradation or loss of mission capability airline is not able to perform its primary function

Assets Major damage to airline assets Financial Major financial loss Human Serious or catastrophic physical harm to individuals Public Perception Total loss of confidence in air traffic by passengers

disclosure of security information

Figure 8 Airborne Network Threat Targets [22]

The subsequent sections describe technical mechanisms to mitigate these risks 41 DIFFERENT UNIVERSES STAND-ALONE VERSUS NETWORKED

It is commonly recognized that the safety and security assurance properties of stand-alone systems are much more easily ascertained than the assurance of systems within networked environments This difference is primarily due to the fact that the assurance of stand-alone entities is a function of the inherent design of that system itself These include the repertoire of issues currently considered by DO-178B such as hardware and software design input-output direct memory access interrupt and interrupt processing design and development process controls operating system (OS) issues and security modes The assurance of networked systems by contrast is a function of not only that systemrsquos own internal design and processes

21

but also the implications of the effects to its design and operation caused by the other elements within the total system as a whole As Joel Knight has observed

ldquoUnless a system is entirely self contained any external digital interface represents an opportunity for an adversary to attack the system It is not necessary for an adversary to have physical access Of necessity many systems will communicate by radio and digital radio links present significant opportunities for unauthorized accessrdquo [7]

A great many issues partially determine the susceptibility of any networked item to possible attacks bull To what extent is an entity manageable If it is manageable how secure is the identity

authentication authorization and access control processes imposed upon administrative personnel and processes (eg separation of duties with least privilege)

bull To what extent is the entity configurable If it is configurable what controls ensure that

it is configured correctly bull How confident (eg assurance level) is the designer certifier and designated approving

authority (DAA) that there is a total absence of latent software bugs that can be attacked by hostile attackers to create safety threatening affects

bull How impervious is the implementation to attacks originating from other devices

including how dependent is the implementation upon inherent network availability or security attributes

bull How dependent is the entity upon other distributed components Can their misbehavior

result in safety threatening scenarios bull What is the relative security and integrity assurance of the data communications

protocols and underlying network media (including networking devices) used within that network infrastructure

The potential interaction of these networked elements is complex The possible complexity of these interactions is a partial function of the number of elements within the total system and the number of possible interaction mechanisms Some possible interactions can be unintended and subtle For example a system can be assured as being safe in a controlled environment using DO-178B processes However is this assurance still viable if that system is transplanted into a highly networked environment where unforeseen processes may try to influence it in unanticipated ways Will a real-time system perform adequately in environments where it is continually being accessed by a rogue process Even if the rogue process fails all authentication and authorization attempts can it still consume enough central processing unit (CPU) or network capacity

22

resources so that the required real-time interactions of that system with its legitimate peers are detrimentally impacted A basic attribute of network environments is that risks to elements within that system increase in direct relationship to the networkrsquos population size The larger the community of networked devices the greater the possibility that at least one of those devices has been constructed with latent bugs that can be leveraged to compromise that device to directly or indirectly attack other parts of the system Also the larger the community of humans that can access elements within the total network system the greater the possibility that at least one of those humans will exploit bugs either intentionally (maliciously) or accidentally Hostile electronic attacks may be conducted by both the corrupted insider (eg insider threat) as well as by unauthorized personnel who have leveraged system or process blemishes to gain unauthorized (remote) entry into the system It can also occur by means of accidental mistakes made by authorized personnel Widely used COTS network equipment such as Internet technologies is more easily assembled into large network systems than less popular communications technologies For example the Aeronautical Telecommunications Network (ATN) which is used for air traffic management systems today is built using open system interconnect (OSI) protocols OSI protocols are rarely deployed today except within specialized niche environments Because of this it is comparatively difficult to link ATN systems with other networks to create large network communities IP systems by contrast are ubiquitously deployed today Because of this it is comparatively easy to link together IP-based systems with other networks to create large network environments A key point to recognize is that just because an IP-based system is not connected to a large network environment today does not mean that it cannot easily be connected into a large networked environment tomorrow perhaps inadvertently For example inadvertent exposure of allegedly stand-alone (ie physically isolated via an air gap) IP networks to remote Internet-based attacks have occurred many times in real life by means of inadequately secured modems located within those allegedly isolated networks Widely deployed public networks have larger populations of users than small private networks The more people within the networking community the greater the probability that one or more of them may pose an attack risk to the elements within the system The larger the cumulative number of users within any aspect of the network the greater the possibility is that a user may purposefully or accidentally exploit those weaknesses in a detrimental manner The inclusion of the words ldquoaspect of the networkrdquo in the previous sentence is a reference to a technical point that is partially explained within appendix A That point is that in large network-of-network systems such as the worldwide Internet network access control defenses are established between discrete network administrative entities by means of security firewalls [23] Firewall technologies have significantly improved over time Unfortunately so has the sophistication of attacks against them A class of exploits3 exist that may possibly circumvent the access control protections of firewall systems Should these attacks succeed then those attackers could access network systems where they are not authorized

3 eg fragmentation attacks time-based attacks HTTP-based (Port 80) attacks and other emerging exploits

23

Specifically most networks implement firewall policies that permit remote access into the autonomous systems (AS) they protect through a port 80 (ie HTTP) overt channel Consequently many sophisticated attacks explicitly leverage the policy weakness that enables this overt channel to penetrate firewall systems Only a small percentage of currently deployed networks today have closed port 80 Even when administrative policy permits this vulnerability to be closed the efficacy of correctly configured firewalls using the very best technology can be circumvented by client-side attacks (see section 42) or improper configuration of other system elements (eg modems) Also firewalls that are deployed in SWAP-constrained environments (eg aircraft) are often susceptible to a range of modern attacks (eg fragmentation attacks time-based attacks) because they may not contain the necessary resources (eg CPU or RAM) to handle those attack vectors Consequently firewall protections can potentially be circumvented Firewalls therefore need to be part of a larger defense-in-depth system (see section 51) which needs to provide redundant protections (eg virtual private networks (VPN) see section 56)) to supplement the firewall in case its protections are circumvented In view of this potential danger the number of people that can access a network should not be equated to the number of people that are authorized to access that network Rather it should be considered to be the total number of people that can access any part of the larger network system in which that network is a part This explicitly includes users that are solely authorized to access another network to which onersquos own network is only indirectly connected Consequently if airplanes are even indirectly connected to the Internet then theoretically there are over one billion people that can potentially access entities within that airplane 42 INTERNAL EXTERNAL AND CLIENT-SIDE ATTACKS

Because networked systems traditionally use perimeter defense mechanisms (security firewalls) to limit access to internal network resources a distinction has been created between insiders and outsiders An insider is an individual who is authenticated and authorized to use internal network resources regardless of whether or not they are physically located geographically in the same location as the networked resource Outsiders are not authorized to have such access A large percentage of security controls have historically been centered on repelling security attacks from outsiders This reflects the fact that insiders usually undergo scrutiny to obtain their authorizations However higher assurance environments need to consider the possible threats stemming from corrupted insiders (ie the insider threat) These environments need to deploy controls so that the activities of all authorized users inside the network are restricted in terms of separation of duties with least privilege Unfortunately an entirely new class of attack the client-side attack has become increasingly popular and dangerous Client-side attacks include inadvertent exposure to hostile e-mail attachments or accesses to malicious web pages containing executables or scripts that allow arbitrary code to run In both cases the attacker leverages latent security vulnerabilities within the userrsquos web browser or e-mail client

24

ldquoWith the rise of client-side attacks a flaw emerges in the old [security] model despite avoiding a direct connection to the outside users might still be attacked by the very services that theyrsquove requestedrdquo [24] ldquoA new attack vector has been created in which users are transformed into a platform to attack internal resources without their consent or even their awareness Users are no longer passive participants in the security model theyrsquove become the very service by which entrance is gained into the protected interior of the networkrdquo [16]

There are many published examples of successful client-side attacks including the following

ldquoThe Oregon Department of Revenue has been contacting some 2300 taxpayers this week to notify them that their names addresses or Social Security numbers may have been stolen by a Trojan horse program downloaded accidentally by a former worker who was surfing pornographic sites while at work in January [2006] An investigation by agency security personnel and the Oregon State Police found that the malicious program was designed to capture keystrokes on the former employeersquos computer hellip The employee was an entry-level worker who was assigned to enter taxpayer name and address changes as well as some social security numbers lsquoWe know that the information that the Trojan gathered up was transmitted outside of the agencyrsquo to an unrelated Web site The incident is still under investigationrdquo [25]

Therefore attacks against networked entities may occur from outsiders from corrupted insiders as well as from client-side attacks (see figure 9) The effect of outsider attacks is to emphasize perimeter defense protections (eg firewalls VPNs) The effect of corrupted insiders is that network security is no longer primarily a function of establishing adequate perimeter defense controls it now must also include viable access control within the network itself The effect of client-side attacks is that network security is no longer solely a function of the total control protections established on devices within the network It is now also reliant upon the appropriate activities of every human using those network resources While filtering services located at the perimeter defense firewalls can and do combat client-side attacks however new attacks are continually being devised that perimeter defense filtering systems must be updated to identify and eliminate Consequently there is often a vulnerability window between when a new attack type has been devised and when the protections against that new attack have been deployed For this reason defense against client-side attacks heavily relies upon end-user educationmdashand can be circumvented by end-user mistakes

25

bull Corrupted or Careless Insiderbull Are authorized to access the networkbull Eg NAS personnel aircraft personnel or passengers local systems

bull Hostile Outsiderbull Are not authorized to access the networkbull May be located on ldquothe Internetrdquo

bull Client-side Attacksbull Malicious software lurking in ldquoneutralrdquo environments (eg email web

sites other) bull The historic distinction between ldquodatardquo and ldquocoderdquo is vanishingbull NAS personnel aircraft personnel and aircraft passengers may be duped

into inadvertently executing and thereby introducing malicious software into the network

bull Network users therefore have become an integral element of a networkrsquos security defenses

Figure 9 Threat Agents in a Networked Environment

This topic will resume in section 44 when the implications of mixing embedded systems and generic OSs within the same network will be discussed Before that discussion can occur however it is first necessary to discuss the vulnerabilities that exist within a networked environment 43 COMMERICIAL OFF-THE-SHELF VULNERABILITIES IN A NETWORKED ENVIRONMENT

While this section specifically addresses well-known COTS vulnerabilities in networked environments similar problems may or may not exist within embedded avionics systems depending upon whether latent bugs exist within those systems that can be exploited by network attacks Lance Spitzner has gathered together the following statistics which provide partial evidence that the worldwide Internet infrastructure is a very dangerous place bull ldquoAt the end of the year 2000 the life expectancy of a default installation of Red

Hat 6 a commonly used version of Linux [a computer OS] was less than 72 hours

bull One of the fastest recorded times a honeypot [ie a device deployed in order to

study the behavior of electronic attackers] was compromised was 15 minutes This means that within 15 minutes of being connected to the Internet the system was found probed attacked and successfully exploited by an attacker The record for capturing a worm was under 90 seconds

26

bull During an 11-month period (April 2000-March 2001) there was a 100 percent increase in unique scans and an almost 900 percent increase in Intrusion Detection Alerts based on Snort [an Intrusion Detection utility]

bull In the beginning of 2002 a home network was scanned on average by 31 different

systems a dayrdquo [26] This list can be supplemented by many other data points including bull ldquoThe most virulent [computer] virus to date infected several million machines in

about 20 minuteshelliprdquo [15] bull ldquoWhen we put this [honeypot] machine online it was on average hit by a

potential security assault every 15 minutes None of these attacks were solicited merely putting the machine online was enough to attract them The fastest an attack struck was mere seconds and it was never longer than 15 minutes before the honeypot logged an attempt to subvert it hellip

bull At least once an hour on average the BBC honeypot was hit by an attack that

could leave an unprotected machine unusable or turn it into a platform for attacking other PCs hellip

bull By using carefully crafted packets of data attackers hope to make the PC run

commands that hand control of it to someone else Via this route many malicious hackers recruit machines for use in what is known as a botnet This is simply a large number of hijacked machines under the remote control of a malicious hackerrdquo [27]

bull ldquoIronPort recently published a report showing that Trojan horses and system

monitors ndash two of the most serious types of malware ndash infect one out of every 14 corporate PCs That means that in an organization of 1000 desktop PCs there is an average of 70 computers that represent a major security risk hellip Dwarfing Trojans and system monitors are less serious types of malware such as adware and tracking cookies which infect 48 and 77 of PCs respectivelyrdquo [28]

bull ldquoThe number of new [COTS] software security vulnerabilities identified by

security experts hackers and others during the first eight months of this year [2006] has already exceeded the total recorded for all of 2005 according to Internet Security Systems Vulnerabilities through September have reached 5300 leaping past the 5195 discovered for all of 2005 says Gunter Ollmann director of the X-Force research group at ISS lsquoEight hundred seventy-one were found to affect Microsoft operating systems while 701 vulnerabilities were only found to affect Unix operating systemrsquo Ollmann says But many vulnerabilities cross platform

27

boundaries to affect them all including Linux About 3219 vulnerabilities fall into that realm Ollmann notes ISS ranks vulnerabilities as critical high medium and low Of the 5300 vulnerabilities recorded for 2006 so far 04 percent were deemed critical (could be used to form a prolific automated worm) 166 percent were deemed high (could be exploited to gain control of the host running the software) 63 percent were medium (could be used to access files or escalate privileges) and 20 percent were low (vulnerabilities that leak information or would allow a denial-of-service attack) hellip lsquoOf the 5300 vulnerabilities hellip 876 percent could be exploited remotely 108 percent could be exploited from the local host only and 16 percent could be exploited remotely and localrsquordquo [29]

The Computer Emergency Response Team4 (CERT) coordination center keeps a monotonically increasing list of reported Internet-related security incidents dating from 1988 to 2003 inclusive5 These statistics show that there was more than a 100 percent increase in reported security incidents in 2001 increasing from 21756 in 2000 to 52658 in 2001 The most recent incidents were publicly disclosed in 2003 which had 137529 different reported security incidents As the CERT notes ldquoan incident may involve one site or hundreds (or even thousands) of sites Also some incidents may involve ongoing activity for long periods of timerdquo [30] The CERT ceased reporting the number of security incidents after 2003 because ldquoGiven the widespread use of automated attack tools attacks against Internet-connected systems have become so commonplace that counts of the numbers of incidents reported provide little information with regard to assessing the scope and impact of attacks Therefore as of 2004 we will no longer publish the number of incidents reportedrdquo [30] An example of an undisclosed incident occurring since 2003 is the following

ldquoChinese hackers launched a major attack on the UK Parliament earlier this month the governmentrsquos e-mail filtering company MessageLabs Ltd has confirmed The attack which occurred on Jan 2 [2006] attempted to exploit the Windows Metafile (WMF) vulnerability to hijack the PCs of more than 70 named individuals including researchers secretaries and members of Parliament (MP) themselves E-mails with an attachment that contained the WMF-exploiting Setabortproc Trojan horse were sent to staffers Anyone opening this attachment would have enabled attackers to browse files and possibly install a key logging program to

4 CERT see httpwwwcertorg 5 See httpwwwcertorgstatscert_statshtml

28

NOTICE

This document is disseminated under the sponsorship of the US Department of Transportation in the interest of information exchange The United States Government assumes no liability for the contents or use thereof The United States Government does not endorse products or manufacturers Trade or manufacturers names appear herein solely because they are considered essential to the objective of this report This document does not constitute FAA certification policy Consult your local FAA aircraft certification office as to its use This report is available at the Federal Aviation Administration William J Hughes Technical Centerrsquos Full-Text Technical Reports page actlibrarytcfaagov in Adobe Acrobat portable document format (PDF)

Technical Report Documentation Page

1 Report No

DOTFAAAR-0831

2 Government Accession No 3 Recipients Catalog No

4 Title and Subtitle

NETWORKED LOCAL AREA NETWORKS IN AIRCRAFT SAFETY SECURITY AND CERTIFICATION ISSUES AND INITIAL ACCEPTANCE CRITERIA (PHASES 1 AND 2)

5 Report Date November 2008

6 Performing Organization Code

7 Author(s)

Eric Fleischman Randall E Smith and Nick Multari

8 Performing Organization Report No

9 Performing Organization Name and Address

The Boeing Company PO Box 3707 MC 7L-49 Seattle WA 98124-2207

10 Work Unit No (TRAIS)

11 Contract or Grant No

DTFACT-05-C-00003

12 Sponsoring Agency Name and Address

US Department of Transportation Federal Aviation Administration Air Traffic Organization Operations Planning Office of Aviation Research and Development Washington DC 20591

13 Type of Report and Period Covered Final Report December 2004-December 2006

14 Sponsoring Agency Code AIR-120

15 Supplementary Notes

The Federal Aviation Administration Airport and Aircraft Safety RampD Division Technical Monitor was Charles Kilgore 16 Abstract

This report presents the results of the Federal Aviation Administration (FAA) local area network (LAN) research effort addressing potential safety impacts introduced by LANs in aircraft Interconnecting previously isolated components on aircraft increases the complexity of unintended interactions between components and provides potential new access points that could be exploited to cause harm This report addresses the potential security vulnerabilities introduced by networking LANs the safety affects of security failures and a process for designing and certifying LANs on aircraft to ensure the safety of these new aircraft systems This report extends the current FAA safety assurance processes into airborne networked environments by leveraging the Biba Integrity Model It builds upon existing FAA studies that articulate mechanisms to integrate RTCADO-178B and common criteria processes for the National Airspace System This approach creates a safety-oriented airborne networked architecture that is built upon existing DO-178B and Aerospace Recommended Practice 4754 safety mechanisms This produces results that are a direct analog to existing US Department of Defense policies and processes 17 Key Words

Local area network Network Aircraft safety Aircraft security

18 Distribution Statement

This document is available to the US public through the National Technical Information Service (NTIS) Springfield Virginia 22161

19 Security Classif (of this report) Unclassified

20 Security Classif (of this page) Unclassified

21 No of Pages 204

22 Price

Form DOT F 17007 (8-72) Reproduction of completed page authorized

TABLE OF CONTENTS Page EXECUTIVE SUMMARY xiii 1 INTRODUCTION 1

2 OBJECTIVES AND APPROACH 7

21 Notional Networked Aircraft Architecture 9 22 Why Both Target Alternatives Have Similar Security Postures 13

3 EXTENDING THE CURRENT FAA CERTIFICATION ENVIRONMENT 15

4 NETWORK RISKS 19

41 Different Universes Stand-Alone Versus Networked 21 42 Internal External and Client-Side Attacks 24 43 Commerical Off-the-Shelf Vulnerabilities in a Networked Environment 26 44 Mixing Embedded Systems and Generic Operating Systems 31 45 Internet Protocol Family Security 35 46 Network ManagementmdashNetwork Security Concern 43

461 The SNMP has no Provisions for Two-Factored Authentication 44 462 The SNMP Symmetric Keys may be Assembled From Passwords 44 463 The SNMP Key Updates do not Provide for Perfect Forward Secrecy 45 464 The SNMP Symmetric Key Distribution Problems 45 465 The SNMP Currently Lacks Demonstrably Viable Session Keys 46

47 Mixing Different Communication Protocol Systems 46

471 Significant Semantic Differences to Allegedly Similar Concepts 48 472 Integrating Dissimilar Protocol Families 48

48 Identity Problem 50 49 Integrated or Cooperating System of Systems 51

5 NETWORK SECURITY DEFENSES 52

51 Defense-in-Depth 52 52 Department of Defense Networking 55 53 Internet Protocol Topology Hierarchy and Policy Systems 58 54 Mechanisms to Connect Aircraft to Networks 59

541 Aircraft and Network Mobility 60

iii

542 Aircraft as a Node (MIP and MANET) 60 543 Multilevel Network Systems (RED-BLACK VPN) 61

55 Airplane Routing and Autonomous Systems 62 56 Virtual Private Networks Enable Network Partitioning 66 57 Security Zones and Policy-Based Networking 69

6 RELATING SAFETY AND SECURITY FOR CERTIFICATION 73

61 Security Requirements of Airborne Networked Environments 74

611 Integrity 75 612 Availability 77 613 Authentication 78 614 Confidentiality 79 615 Nonrepudiation 79

62 Extending FAA Orders Guidance and Processes Into Vast Network Systems 79 63 Comparing Civilian Aircraft Safety and Federal Government Security Levels 83

631 Civil Aircraft Software Levels 83 632 Federal Government Security Classifications 85 633 Comparison of the Two Policy Systems 86

64 Biba Integrity Model and Bell-LaPadula Confidentiality Model

are Direct Analogs 87

65 Relating Safety Classification Levels to the CC 90 7 EXTENDING FAA CERTIFICATION TO AIRBORNE NETWORKS 93

71 Extending ARP 4754 Into Networked Environments 94 72 Extending DO-178B Into Networked Environments 96

8 CANDIDATE SAFETY AND SECURITY NETWORK SOLUTION 98

81 System Security Engineering Methodology 99 82 Applying the SSE Methodologies to Airborne Networks 102 83 Exemplar Airborne Network Architecture Solution 105

831 The VPN Encapsulation Method 108 832 Physical Security 114 833 Encapsulation Gateways 115 834 Packet Filter 116 835 Firewall 117 836 The ASBR Router 117

iv

837 High-Assurance LAN 118 838 Quality of Service 118 839 Air-to-Ground and Air-to-Air Communications 118

84 Network Management Extensions 119

9 ANSWERS TO THE PHASE 1 QUESTIONS 122

91 Connection of Multiple Domains 122

92 Integrated Modular Avionics Implementation 123

93 Using Public IPs 125

94 Electronic Flight Bags 125

95 Updating Security Protection Software 127

96 Responding to Security Breaches 128

97 Access to Aircraft Data 129

98 Adequacy of Existing Regulations 129

99 Ground-to-Air Communication 130

910 What is the Efficacy of Cyclic Redundancy Checks With Respect to Security 130

10 ANSWERS TO THE PHASE 2 QUESTIONS 131

101 Are Current Regulations Adequate to Address Security Concern 131

102 How Does Security Assurance Fit Into Overall Certification Process 132

103 What Should Network Security Assurance Process Contain to Meet XX1309 132

104 How Will Continued Airworthiness and Maintenance be Addressed 134

105 How Can it be Ensured That Networked Systems Cannot Impact Safety 135

106 What Should the Process be for Updating Security Protection Software 135

107 How can Security Breaches be Handled 136

11 SUMMARY 137

v

111 Findings and Recommendations 139 112 Topics Needing Further Study 147

12 REFERENCES 148

13 RELATED DOCUMENTATION 156

14 GLOSSARY 157

APPENDICES

AmdashHistoric Attack Mechanisms and Tools BmdashFAA LAN Survey Results

vi

LIST OF FIGURES

Figure Page 1 Notional Networked Aircraft Architecture 10 2 Generic Future Communication System Physical Architecture 11 3 Alternative Notional Aircraft Architecture 11 4 Both Target Architectures Have Similar Security Profiles 14 5 Three Different Software Certification Environments 16 6 The FAA Five Layers of System Protection 19 7 Network Threat Mission and Operational Impact 21 8 Airborne Network Threat Targets 21 9 Threat Agents in a Networked Environment 26 10 A Sample Deployment 30 11 Comparison Between the OSI and TCPIP Protocol Stacks 46 12 Transforming Islands of Communication Into a Single Logical Network Infrastructure 49 13 Internet Protocol Stack to Convey Legacy Protocols 50 14 Overlapping Defense-in-Depth IA Systems 53 15 Sample Defense-in-Depth Technologies 54 16 Control Life Cycle 55 17 The DoD COMSEC End-to-End Packet Flow (IPV4 Example) 56 18 Representation of how Aircraft may Function Within the GIG 57 19 Internet Protocol Topology Hierarchy 59 20 Interfaces Between Customer and Service Provider Networks 67 21 Example of VPN Encapsulation Using IPsec 68

vii

22 Customerrsquos L3VPN Protocol Stack Shown Within the Network 69 Service Providerrsquos Network 23 Historic PBN Framework 70 24 Code- and Document-Signing Process 76 25 Code- and Document-Signing Verification Process 76 26 Bell-LaPadula Confidentiality and Biba Integrety Models Compared 82 27 DO-178B Classifications Using Biba Integrity Model 89 28 Gap Analysis in the Alves-Foss et al Study 93 29 Security Engineering Process 100 30 Secure Generic Airborne Network Design (High-Level View) 106 31 How Design Addresses Network Risks 107 32 How Design Addresses Network Threats 108 33 Close-Up Detail of How Encapsulation is Accomplished 109 34 VPN Interconnecting Two Sites 110 35 Sample Airborne Network Management 120 36 Notional IMA Design (Example 1) 124 37 Notional IMA Design (Example 2) 124

viii

LIST OF TABLES Table Page 1 Internet Engineering Task Force Protocol Security Features

and Key Management Configuration 36 2 Comparison of Safety Levels to Security Classifications 86

ix

LIST OF ACRONYMS AND ABBREVIATIONS AC Advisory Circulars ACARS Aircraft Communications and Reporting System AFDX Avionics Full-Duplex Switched [Ethernet] AJ Anti-jamming ARP Aerospace Recommended Practice AS Autonomous system ASBR AS boundary router (alternatively AS Border Router) ATN Aeronautical Telecommunications Network BGP Border Gateway Protocol CA Certificate Authority CC Common criteria CE Customer edge CERT Computer Emergency Response Team CFDIU Central fault display information unit CIDR Classless interdomain routing CIM Common information model CIO Chief Information Officer CLNP Connectionless network protocol COMSEC Communications security CONOPS Concept of Operations CONS Connection-oriented network service COPS Common Open Policy Service COTS Commercial off-the-shelf CPU Central processing unit CRC Cyclic redundancy check DAA Designated approving authority DARPA Defense Advanced Research Projects Agency DEN Directory-enabled networking DHCP Dynamic host configuration protocol DMTF Distributed Management Task Force DNS Domain Name System DoD Department of Defense DoDI Department of Defense Instruction DoS Denial of service DSS Digital Signature Standard EAL Evaluation assurance level EFB Electronic flight bag EGP Exterior gateway protocol ESP Encapsulating security payload FAA Federal Aviation Administration FIPS Federal Information Processing Standard FTP File transfer protocol GIG Global information grid HAG High-assurance guard

x

xi

HMAC Hashed Message Authentication Code HTTP Hypertext transfer protocol IA Information assurance IATF Information Assurance Technical Framework ICMP Internet control message protocol IDS Intrusion detection system IETF Internet Engineering Task Force IGP Interior gateway protocol IMA Integrated modular avionics IP Internet protocol IPsec Internet protocol security IPSP Internet protocol security policy ISMS Integrated security model for SNMP ISP Internet service providers IS-IS Intermediate system to intermediate system IT Information technology L2VPN Layer 2 virtual private network L3VPN Layer 3 virtual private network LAN Local area network LDAPv3 Lightweight directory access protocol version 3 LLC Limited Liability Corporation LPILPD Low probability of interceptlow probability of detection MAC Mission assurance category MANET Mobile ad hoc networking MIB Management information base MIP Mobile Internet protocol MOSPF Multicast open shortest path first (protocol) MPLS Multiprotocol label switching MSLS Multiple single levels of security NAS National airspace system NAT Network address translator NEMO Network mobility NFS Network file system NIDS Network intrusion detection system NIST National Institute of Standards and Technology NMS Network management system NSA National Security Agency NTP Network time protocol OMT Onboard maintenance terminal OS Operating system OSI Open system interconnect OSPF Open shortest path first (protocol)

PBN Policy-based networking PC Personal computer PE Provider edge PEP Policy enforcement point PFS Perfect forward secrecy PIB Policy information base PIM-DM Protocol-independent multicast-dense mode PIM-SM Protocol-independent multicast-sparse mode PKI Public key infrastructure PPS Ports protocols and services QoS Quality of service RAM Random access memory RFC Request for comment (ie Publications of the IETF) RPC Remote procedure call RSA Rivest Shamir Addleman RTP Real-time protocol SA Security association SATS Small aircraft transportation system SBU Sensitive but unclassified SLA Service level agreement SMTP Simple mail transfer protocol SNMP Simple network management protocol SPD Security policy database SSE System security engineering SSH Secure shell (protocol) SWAP Size weight and power SYN Synchronous (bit) TCP Transmission control protocol TCSEC Trusted Computer System Evaluation Criteria TFTP Trivial file transfer protocol TLL Time to live TLS Transport layer security TP Transport layer protocol TSIG Secret key transaction authentication for DNS UDP User datagram protocol V Version VPN Virtual private network WAN Wide area network

xii

EXECUTIVE SUMMARY

This is the final report of a 2-year Federal Aviation Administration (FAA)-funded study to address security and safety issues associated with networked airborne local area networks This study consisted of two phases Phase 1 investigated the methodologies for identifying and mitigating potential security risks of onboard networks that could impact safety Phase 2 investigated techniques for mitigating security risks in the certification environment Current FAA safety assurance processes for airborne systems are based on Aerospace Recommended Practice (ARP) 4754 ARP 4761 and Advisory Circulars (AC) (eg AC 251309-1A and AC 231309-1C) FAA software assurance is based on compliance with DO-178B that guides software development processes Complex electronic hardware design assurance is based on RTCADO-254 ARP 4754 extends the DO-178B software assurance process to address the additional safety issues that arise when software is embedded into highly integrated or complex airborne system relationships Connecting airborne software within network systems represents an extension of the ARP 4754 environment to networked items that share limited common functional relationships with each other This is because networks connect entities or components of a system into a common networked system regardless of the original functional intent of the system design (eg multiple aircraft domains can be connected by a common network system) Networks are inherently hostile environments because every network user including both devices (and their software) and humans is a potential threat to that environment Networked entities form a fate-sharing relationship with each other because any compromised network entity can theoretically be used to attack other networked entities or their shared network environment Networked environments and the entities that comprise them need to be protected from three specific classes of threat agents (1) the corrupted or careless insider (2) the hostile outsider and (3) client-side attacks Because of these dangers ARP 4754 needs to be extended for networked environments by ensuring network security protection and functioncomponent availability and integrity This in turn implies the need to strategically deploy information assurance security controls within network airborne systems Safety and security have therefore become intertwined concepts within networked airborne environments Security engineering addresses the potential for failure of security controls caused by malicious actions or other means Safety analysis focuses on the effects of failure modes The two concepts (safety and security) are therefore directly related through failure effects A shortcoming of either a safety process or a security process may cause a failure in a respective system safety or security mechanism with possible safety consequences to the aircraft depending on the specific consequence of that failure Previous studies have sought to address airborne safety and security by correlating DO-178B safety processes with common criteria security processes This correlation produces necessary but inadequate results It is inadequate because it lacks mathematical rigor and therefore produces ad hoc conclusions The results are ad hoc because even when safety and security are correlated they are nevertheless distinct concepts from each other addressing very different concerns

xiii

xiv

This report states that the primary issue impacting network airborne system safety is how to extend existing ARP 4574 ARP 4761 DO-178B and DO-254 assurance guidance processes into networked systems and environments in a mathematically viable manner This study recommends that these processes can be extended into arbitrarily vast network environments in a mathematically viable manner by using the Biba Integrity Model framework This report maps current DO-178B and ARP 4754 processes into the Biba Integrity Model framework using well- established system security engineering processes to define airborne safety requirements It applies best current information assurance techniques upon those airborne safety requirements to create a generic airborne network architecture Since the Biba Integrity Model is an integrity framework it carries within itself a natural mechanism for relating safety and security concepts in terms of their respective integrity attributes Nevertheless this study recommends that the model be implemented solely within the context of existing FAA safety processes This results in airborne network systems being organized into networks that operate at specific safety levels (the DO-178B software levels) There are fortuitous secondary effects from using the Biba Integrity Model to extend current FAA processes into networked environments that stem from it being the direct analog of the Bell-LaPadula Confidentiality Model The Bell-LaPadula Confidentiality Model forms the framework for confidentiality within US Department of Defense (DoD) information processing Consequently the application of the Biba Integrity Model to airborne system assurance processes results in an airborne network architecture that remarkably resembles the emerging DoD network architecture (the global information grid (GIG)) despite their very different underlying goals Consequently the generic airborne network architecture identified by this study greatly resembles the DoDrsquos GIG architecture While military technologies could be used to implement the airborne network architecture this study recommends the use of civilian Internet protocols deployed as a virtual private network In addition the similarities between the Biba Integrity Model and the Bell-LaPadula Confidentiality Models may result in increased synergies between the DoD and FAA certification processes Deploying airborne systems into networked environments means that the FAA system safety assessment (ARP 4761) system development (ARP 4754) software assurance (DO-178B) and complex electronic hardware assurance (DO-254) processes need to be extended to address and mitigate network threats For example although security is primarily a systems concept involving system issues (eg ARP 4754) the Biba Integrity Model relies upon the networked items having integrity attributes that function at a known assurance level (ie specific DO-178B software levels) This means that the processes for developing those items for network environments should be extended to address network attack risks The concept of high-assurance software in networked environments should therefore mean that items and systems will behave in the same manner before during and after network attacks ie be immune to potential network-based threats Exploits in network environments leverage latent software blemishes so that software items are subject to misbehavior corruption or compromise possibly including

use as a launching pad to attack other systems and items Current DO-178B processes do not currently include mechanisms to identify and fix well-known network attack vectors This study identifies specific additional tests to perform that function Unfortunately software testing alone cannot result in high-assurance software This is because tests only identify the flaws for which the tests are designed to identifymdashthey cannot warrantee the absence of other flaws that were not addressed by the test suite There is no existing security theory or process that can be leveraged to produce guaranteed high-assurance results for networked environments This is a very significant certification issue Until a solution for this problem is found this study recommends that the FAA ensure that high-assurance software complies with formal models and undergoes a rigorous line-by-line code inspection to demonstrate a lack of bugs that can be hostilely attacked

xvxvi

1 INTRODUCTION

This is the final report of a 2-year Federal Aviation Administration (FAA)-funded study to address security and safety issues associated with networked airborne local area networks (LAN) This study consisted of two phases Phase 1 investigated the methodologies for identifying and mitigating potential security risks of onboard networks that could impact safety Phase 2 investigated techniques for mitigating security risks in the certification environment Individual systems onboard aircraft are designed to meet specific operational functional and physical requirements The safety requirements of a flight-critical avionics system differ from a cabin management system or a passenger in-flight Internet service If these systems become interconnected incompatibilities in design assumptions administrative policies user interaction and data security considerations increase their exposure to risk Actions taken in the context of an open passenger network (whether originating onboard an airplane or from some remote site via a network connection) must be prevented from introducing flight-safety risks to flight-critical systems Airborne systems are designed built and approved in accordance with airworthiness requirements Current FAA safety assurance processes for airborne systems are based upon Aerospace Recommended Practice (ARP) 4754 [1] ARP 4761 [2] and Advisory Circulars (AC) eg AC 231309-1C [3] and AC 251309-1A [4] FAA software assurance is based on compliance with RTCADO-178B [5] that guides software development processes Complex electronic hardware design assurance is based on RTCADO-254 [6] The primary FAA certification standards are the respective regulations FAA policy and the ACs This study addresses how to extend current FAA processes and certification environment to include networked airborne LANs in a mathematically viable manner Because of the extensive scope of the current FAA policies and processes this report addresses this larger issue by specifically explaining how to extend the software assurance subset Other aspects of FAA policy and processes can be extended into networked environments in a parallel manner (ie by leveraging a security model framework see section 62) DO-178B is one means to secure approval of airborne software The system safety assessment processes (ARP 4754 and ARP 4761) determine failure conditions of the system and define safety-related requirements as input to the software life cycle processes DO-178B identifies the software level of a software item based on the potential contribution of the software to failure conditions for the entity in question Software level refers to the worst-case result of a failure of that software upon aircraft safety in terms of one of five possible failure condition categories The failure condition categories range from failure conditions that would prevent the aircraftrsquos continued safe flight and landing (catastrophic) to failure conditions that do not affect the operational capability of the aircraft nor increase crewrsquos workload (no effect) Higher software levels and greater assurance protections are provided to entities that would have higher safety consequences should they fail DO-178B also addresses some software design and certification considerations for user-modifiable software option-selectable software commercial off-the-shelf (COTS) software and other software-related issues

1

Similar guidance is also provided for airborne electronic hardware (eg DO-254) The principals that pertain to networking airborne systems that are addressed in this report directly pertain to all networked system entities both software and hardware This reportrsquos resulting exemplar network architecture (see section 83) is therefore agnostic concerning whether the airborne networked entities are hardware software or a combination of both Historically many software entities onboard aircraft are embedded in systems performing specialized mission-related functions COTS-generic computing devices are increasingly being deployed within the National Airspace System (NAS) and they are occasionally deployed within aircraft as well1 John Knight [7] identifies two primary reasons for the increased use of general-purpose computing devices and hardware (eg microprocessors random access memory (RAM) and memory management unit) 1 For enhanced avionics functionality Specifically entirely new concepts become

possible with the introduction of digital systems These include modern autopilot technology with greater functionality and flexibility than was possible with historic analog systems modern full authority digital engine controls envelope protection systems and flight deck automation (ldquoglass cockpitrdquo)

2 For enhanced safety Examples include aircraft condition analysis and management

systems structural health monitoring and automatic alerts of potential runway incursions

DO-178B and supporting advisory circulars address all phases of the software development process for all software types to ensure that airborne systems are safe This includes electronic flight bag computing devices [8] These cumulative systems processes and guidelines were historically targeted for aircraft environments whose internal networks are specialized to accomplish specific mission functionality Aircraft devices are historically connected via specialized and sometimes proprietary data buses to other devices with which they perform associated functions The nature of these connections is tailored to support their specific communication requirements (eg deterministic real time asynchronous etc) Air-to-ground communication similarly occurs via special-purpose communication systems using special-purpose data communication protocols Visionaries anticipate forces that could motivate future airborne system designs to replace todayrsquos diverse data bus systems within aircraft including many of their current constraints (eg access point limitations proprietary protocols labeling and mitigations such as cyclic redundancy checks) with airplane-appropriate LAN technologies that support standard Internet

1 COTS software components are very rare critical airborne systems and are discouraged from being deployed in

those environments because they cannot comply with DO-178B and other software policy in general

2

protocol (IP)-based communications For example reference 9 concluded that Ethernet-based LANs could be appropriate to serve as aviation data buses if they use

ldquoa switched Ethernet topology along with traffic regulation bandwidth restriction (guarantee and control of bandwidth allocation) and call admission controlrdquo

Coupled with the linkage of aircraft systems via a common network system is a growing perception of the desirability to improve and enhance air-to-ground and air-to-air communication systems and processes as well as to more closely integrate airborne systems with NAS systems For example bull Integrating multiple data bus systems into onboard LAN(s) is expected to reduce aircraft

size weight and power (SWAP) overheads thereby improving aircraft flight performance parameters

bull Next generation aircraft display systems may want to combine map and air traffic data

terrain information weather radar returns information on man-made obstacles and imagery on the airport environment This would require fusing data from sources that are not currently associated together It would also necessitate the support of high-bandwidth data communications internally within the aircraft as well as air-to-ground and within the NAS

bull National Aeronautics and Space Administration Small Aircraft Transportation System

(SATS) is investigating mechanisms that would enable small aircraft to fly to and from the 5400 small airports that are not currently being used for reliable public transportation ldquoA key to implanting SATS is a robust and extremely reliable automated communications system The system must be capable of passing large amounts of data between aircraft and ground systems as well as between neighboring aircraft in a reliable mannerrdquo [10]

bull George Donohue former FAA Associate Administrator of Research and Acquisition has

expressed concerns that the United Statesrsquo

ldquoair transportation network is seriously overloaded in the major cities that support airline hub operations hellip This hellip is leading to a gradual decrease in the US air transportation system safety hellip There is a growing consensus over the last 3 years that the capacity of the US National Airspace System is finite and currently approaching critical saturation limits hellip Without new technology and operational procedures we cannot increase capacity without decreasing the systems safety hellip Without increased capacity the increased cost of air transportation will effectively suppress demand (for new aircraft domestic tourism international travel etc) and have a profound effect on the nationrsquos culture and economy hellip System maximum capacity is very sensitive to aircraft final approach spacing Decreasing aircraft separation in the final approach to a runway from an average of 4 nautical miles between aircraft to 3 nautical miles

3

would increase this capacity in the USA [from the current 30 million operations per year] to over 40 million operations per year hellip [To accomplish this] all commercial aircraft will need to have double to triple redundant collision detection and avoidance systems on the aircraft with professionally trained pilots providing safe aircraft separation The national air traffic control system should be distributed between ground and airborne systems in such a way that it will be almost immune to single point failureshelliprdquo [11]

bull Arguments that the air traffic management system should become network centric to

ultimately achieve the NAS goals Dennis Buede John Farr Robert Powell and Dinesh Verma define a network centric-system as

- ldquoA network of knowledgeable nodes shares a common operating picture

and cooperates in a shared common environment - Functional nodes reside in the cognitive physical and information

domains and communicate with each other and between domains - The heart of the system is the network Knowledgeable nodes may act

autonomously (self-synchronization) with or without a central command and control facility The US Federal Aviation Administration (FAA) refers to the National Airspace System (NAS) which is made up of more than 18300 airports 21 air route traffic control centers (ARTCC) 197 terminal radar approach control (TRACON) facilities over 460 airport traffic control towers (ATCT) 75 flight service stations and approximately 4500 air navigation facilities The airlines and government employ more than 616000 active pilots operating over 280000 commercial regional general aviation and military aircraft hellip

hellip The current improvements to the NAS focus on safety accessibility flexibility predictability capacity efficiency and securityrdquo [12]

bull Evolving airborne software systems to similarly support network centric operations promises enhanced automated aircraft system update procedures and maintenance processes that are not possible with todayrsquos federated systems

The proposed transformation of todayrsquos aircraft and airspace system can be compared to the rapid increase in interoperability seen in commercial and military systems These previous revolutions similarly capitalized on explosive increases in computing power and interconnectivity as well as rapidly evolving protocols and services This rapid rate of change combined with a lack of discipline among commercial vendors who prized functionality over security unfortunately has resulted in a landscape where secure interconnected systems rarely (if ever) exist The anticipated deployment of networked LANs in aircraft is therefore not an isolated event It is a constituent element within the larger network centric evolution of society The implications

4

of linking aircraft-resident systems over a common data bus needs to be considered within the larger context of the network-centric evolution of air-to-air air-to-ground and ground-to-ground communications within the airspace as a whole However with these advantages come risks associated with increased exposure of previously isolated components Aircraft vendors operators and regulators need to understand the impact that interconnected systems may have upon flight safety Design test validation and verification techniques should consider the impact of unanticipated interactions between previously isolated systems In addition the effects of intentional failures caused by malicious software or persons need to be considered Existing evaluation techniques where individual systems have been evaluated in isolation should be updated to address safety concerns introduced by future interconnected systems FAA Order 137082 ldquoInformation Systems Security Programrdquo requires ldquothe FAA must ensure that all information systems are protected from threats to integrity availability and confidentialityrdquo [13] Section 41 of this report explains that networks potentially expose software to larger populations of attack threats As John Knight explains ldquounless a system is entirely self contained any external digital interface represents an opportunity for an adversary to attack the systemrdquo [7] Section 44 explains that COTS computing devices when deployed within networked environments have an indeterminate number of latent security vulnerabilities that can be attacked and potentially exploited COTS systems therefore have very questionable assurance characteristics in networked environments Even though aircraft may not deploy COTS software within their airborne LANs they nevertheless can benefit from the extensive experience gained to date from deploying COTS systems within networks and they may communicate with ground-based networks that widely deploy COTS systems Airborne software and devices unless they have been specifically assured for use in networked environments may or may not manifest similar problems depending on the number and type of bugs present in networked airborne software This is because latent security vulnerabilities when combined with the increased exposure of networked systems can result in security problems that have direct safety implications Vulnerabilities include bull Modification or replacement of authentic aviation software by an alternative variant

introduced by an attacker For example if an attacker could thwart onboard security procedures to download corrupted software of their own choosing then a safety hazard can arise if that corrupted software for example causes the pilotsmdashand the navigation systems they rely uponmdashto believe that their current altitude is 2000 feet higher than it actually is

bull Attacks to network system elements that either hinder correct software operation or else

modify the reported results of correct software operation For example if an attacker takes control of an onboard device and uses it to continuously flood the onboard network with spurious transmissions a safety hazard may arise should that denial of service attack on the network actually succeed in disrupting latency-sensitive real-time transmissions between distributed avionics components and by so doing induce incorrect computation results that affect critical onboard systems

5

Protections against these types of safety threats are primarily accomplished by means of deploying effective information assurance (IA) security controls Safety and security have therefore become intertwined concepts within networked airborne environments Security engineering addresses the potential for failure of security controls caused by malicious actions or other means Safety analysis focuses on the affects of failure modes The two concepts (safety and security) are therefore directly related through failure effects A shortcoming of either a safety process or a security process may cause a failure in a respective safety or security mechanism with possible safety consequences to the aircraft depending on the specific consequence of that failure This study deals with the security and safety issues and acceptance criteria of networked LANs in aircraft In view of the discussion above this study cannot merely evaluate the safety and security implications of introducing LANs to aircraft in an isolated manner Rather the system-wide consequences associated with these changes must be evaluated At a minimum this comprises two distinct but related concepts bull The security and safety issues including acceptance criteria of linking aircraft-resident

systems upon a common network infrastructure This common data bus causes those systems to no longer be physically isolated from each other Rather it links them into a common communications system A direct consequence of this change is that formerly isolated onboard software systems have become theoretically accessible via a common onboard communications system This common onboard communication system is also connected to the aircraftrsquos air-to-ground communication system

bull As described in the bullets shown on pages 3 and 4 anticipated network-centric changes

to the NAS itself results in NAS systems being increasingly redefined into network-centric systems This includes the possibility of aircraft systems being accessible from expanding regions of the NAS Should the NAS itself become connected to public data communications systems such as the Internet then this would result in the theoretical possibility of aircraft being accessible from systems outside of the NAS Specifically should the NAS become connected to the Internet the theoretical possibility exists of accessing aircraft from any location worldwide

By combining these two concepts the net result is the theoretical possibility that specific aircraft-resident systems may become accessible from any location worldwide This possibility has potentially severe safety assurance implications However similar risks result even when no entities using aircraft LANs are involved in communications with entities outside of the aircraft This is because attackers do not need to access aircraft-resident systems to launch electronic attacks upon aircraftmdashsimilar affects can be achieved solely by attacking ground-resident NAS elements For example

ldquoOne of the most frightening images of cyber terrorism is a scenario in which terrorists take over the air traffic control system and cause an aircraft to crash or two planes to collide in flight

6

Industry and governments are extremely sensitive even to the appearance of threats and vulnerabilities A collapse of public confidence in civil aviation safety and a failure to manage public expectation may have serious and widespread economic and social consequencesrdquo [14]

These affects may be similar to the events following the terrorist attacks on September 11 2001 Ken Birman has noted that parallel network-centric evolutions are widespread throughout our society He warns that

ldquoWersquore poised to put air-traffic control banking military command-and-control electronic medical records and other vital systems into the hands of a profoundly insecure untrustworthy platform cobbled together from complex legacy software componentsrdquo [15]

The potential scale of harm from a successful electronic attack against elements within a network-centric NAS system including network-connected aircraft is huge Adversaries may be anonymous and range from individual recreational hackers to well-financed criminal enterprises to well-organized state-led initiatives To the extent that the NAS builds upon COTS technologies the technology employed for electronic attacks will be simple cheap and widely available Reliance upon advances in COTS technology creates an extremely fluid threat environment as historic security vulnerabilities are addressed and new vulnerabilities discovered [16] Fortunately lessons from industry (civilian) and military security processes and experience can be applied to the aviation industry This report therefore examines the safety and security issues introduced by networked LANs on aircraft It seeks to adapt industryrsquos best system security engineering (SSE) practices to identify safety risks caused by aircraft networks It identifies potential security threats and assesses evaluation criteria It leverages best current industry and military practices It proposes specific extensions to ARP 4751 and DO-178B processes to address network security threats and certification issues that arise from networking airborne systems 2 OBJECTIVES AND APPROACH

The purpose of this report is to document evaluation criteria that can be used by certification authorities and industry to ensure that onboard networks will not negatively impact aircraft safety The results will be used by the FAA as input for development of policy guidance and regulations This work is divided into two phases The first phase focused on the potential security risks of onboard networks that affect safety and explored issues and solutions to critical questions raised by the aviation industry as manufacturers consider using LANs in aircraft Initial acceptance criteria for certifying aircraft that use LANs is provided to help evaluators understand the safety and security issues and specific evidence needed to show that proposed designs and countermeasures are sufficient to ensure safety of flight

7

This document also includes the studyrsquos phase 2 effort The phase 2 effort refines the phase 1 results to create specific recommendations to certifiers for the evaluation of the security and safety posture of airplane architectures which include both onboard and offboard networking capabilities Phase 2 also attempts to complete the acceptance criteria started in phase 1 It provides guidelines to help evaluators understand the safety and security issues with networks on airplanes and recommends specific evidence needed to ensure that proposed designs and countermeasures are sufficient to ensure safety of flight This report seeks to answer questions raised by the potential use of LANs on aircraft including bull Are current regulations adequate to address networked airborne security concerns bull How does security assurance fit into the overall certification process including ties to

safety assessment bull What should a network security assurance process contain to enable onboard networks to

meet Title 14 Code of Federal Aviation Part XX1309 [Where XX refers to the particular CFR Part (Parts 23 25 27 29 or 33)]

bull How will continued airworthiness be addressed for onboard networks and how will

regular maintenance be performed in the certification environment bull How can it be ensured that the systems connected to the onboard network cannot

negatively impact safety bull What should the process be for updating security protection software bull How can security breaches be handled Consequently this project bull investigates safety and security issues introduced by using LANs on aircraft bull investigates the potential security risks of an onboard network that could impact safety bull investigates the means for mitigating the security risks in the certification environment bull provides recommendations for assessing safety effects caused by potential security

failures bull provides recommendations for certification of LANs on aircraft

8

21 NOTIONAL NETWORKED AIRCRAFT ARCHITECTURE

Networking aircraft with the NAS is symptomatic of larger societal changes that are arising from the emergence of the worldwide Internet network of networks The Internet has had a profound impact upon many aspects of modern life Many businesses have redefined their relationships with other businesses increasingly basing them upon Internet-oriented electronic commerce technologies The public has also embraced the Internet as witnessed by the growing ubiquity of Internet services such as the worldwide web instant messaging and electronic mail within popular culture Perhaps because of this many aircraft manufacturers are planning to install onboard networks enabling passenger access to the Internet However if an aircraft manufacturer opts to have an onboard network that is available to both passengers and avionics equipment (ie a shared LAN) aircraft safety and security concerns arise As previously mentioned in the introduction parallel evolutionary changes to the NAS increasingly are being proposed that rely upon greater integration between air-based and ground-based airspace systems For example the operational integration of aircraft with the NASrsquo communication and logistics infrastructure promises dramatic improvements in operational efficiency Thus a variety of motivations are increasing the connectivity of aircraft systems to air-based and ground-based network infrastructures Current commercial aircraft systems and networks can be grouped in three major categories closed private and public The closed networks are representative of safety-critical avionics systems private systems represent airline operational systems cabin management systems etc open systems are represented by public Internet services offered to passengers Several changes have been proposed for next generation of aircraft due to the use of local area networking technologies In response to these proposed changes some projects have been initiated in which the common onboard network is designed with partitioning protections The assured robustness of the proposed partitioning is a concern from both a security and safety perspective Previous avionics systems have had their own data bus and have not been accessible by nonavionics systems Security has historically been enforced by a total lack of access (ie an air gap) between systems However as this paradigm changes to support common networked systems the safety and security aspects of the onboard network must be addressed by identifying the resulting risks and establishing appropriate controls to mitigate those risks Several notional views of the current and future aircraft networked systems have been formulated Figure 1 shows one of those views In figure 1 the current (existing) architecture is shown on the left side a logical picture of the proposed target architecture is in the middle and a list of changes to achieve the target (future) architecture is enumerated on the right As previously mentioned a key feature of the existing architecture is its air gap between airborne functions and passenger Internet services Thus there is no way a passenger or entities within

9

the worldwide Internet infrastructure can currently access airborne functions This proposed target architecture alternative by contrast has made three very significant modifications to the current airplane design bull It has created a network within the aircraft itself that supports communications using the

IP protocol family (see section 45) This implies that aircraft control entities logically share a common network infrastructure that is also connected to the nonessential IP network Consequently aircraft control entities are now theoretically connected to nonessential network entities

bull The passenger Internet services have now been connected to the nonessential IP network

This means that all entities within the aircraft will be theoretically connected within the same network system

bull The nonessential worldwide IP network is now connected to NAS and airline ground

systems and the Internet Specifically aircraft control elements are shown to be in the same network system that includes the NAS entities with which they may need to communicate as well as more than one billion people worldwide with Internet connectivity today

Aircraft Control

Airline GroundSystems amp Internet

Non-IP communicationinterface

IP communicationinterface

Existing

PassengerInternetServices

Airborne EquipmentAirborne Equipment

Aircraft Control(containing anIP Network)

Airline GroundSystems amp Internet

Floppy

Non-IP commun-ication interface

IP communicationinterface

Airline GroundSystems amp Internet

Aircraft Control(possibly containing

an IP Network)

Non-essential

IPnetwork

Non-essential

IPnetwork

PassengerInternetServices

Proposed Target

Primary differences in proposed target environment1 Aircraft shares a common

Internet protocol (IP)-based network system

2 Passenger Services AircraftControl and Airline InformationServices share a common network system

3 Specific Aircraft Control andAirline Information Services processes form distributed network relationships with NAS ground computers and potentially other aircraft

Difference1

Difference2

Difference3

Figure 1 Notional Networked Aircraft Architecture

The FAA (ACB-250) community has provided a generic future communication system physical architecture proposal taken directly from reference 17 and is shown in figure 2 which provides greater detail about the network links of the figure 1 target alternative

10

Controller

Aircraftoperator

ATC Voice

ATC Data

AOCAAC Data

Public Internet

Control Site

ControlSite

Equipment

MMC

Technicians

MMC

Technicians

Remote Site

RemoteSite

Equipment

Avionics

Aircraft Pilots

Crew

Passengers

AvionicsAvionics

Aircraft Pilots

Crew

Passengers

Avionics

Aircraft Pilots

Crew

Passengers

AvionicsAvionics

Aircraft Pilots

Crew

Passengers

H

G

G

F

E

Other Control Sites

A

B

C

D

AAC = Airline Administration Communication ATC = Air Traffic Control

AOC = Airline Operational Communication MMC = Maintenance monitor and control

Figure 2 Generic Future Communication System Physical Architecture [17]

Advocates have identified undesirable security implications with the approach shown in figure 1 related to potentially exposing avionics systems to passenger devices and systems These advocates argue that the advantages achieved by removing the historic security air gap between avionics and passenger systems cannot justify the increased risk to avionic systems posed by that connectivity Consequently they have identified an alternative target architecture which is shown in figure 3

Primary differences in proposed target environment1 Aircraft Control and

Airline InformationServices share a common network system

2 Specific Aircraft Control andAirline Information Services processes form distributed network relationships with NAS ground computers byusing an IP-based air-to-groundlink

However the air gap between the Aircraft passengers and the avionics systems remains in tact

Aircraft Control

Airline GroundSystems amp Internet

Non-IP communicationinterface

IP communicationinterface

Existing

PassengerInternetServices

Airborne EquipmentAirborne Equipment

Aircraft Control(containing anIP Network)

Airline GroundSystems amp Internet

Floppy

Non-IP commun-ication interface

IP communicationinterface

Airline GroundSystems

Aircraft Control(possibly containing

an IP Network)

Non-essential

IPnetwork

Non-essential

IPnetwork

PassengerInternetServices

Proposed Target

Internet

Difference1

Difference2

Figure 3 Alternative Notional Aircraft Architecture

11

While there are strong motivations (see section 1) arguing for the migration indicated in either figure 1 or figure 3 to take place there are security and safety reasons for why the current airborne architecture should not change Specifically the existing system is safer and more secure than either of the target systems Section 4 explains some of the reasons why the proposed changes that form the target designs result in significantly more risk to aircraft A summary of these reasons include the following bull The larger the networked community of devices the larger the potential number of

threats to the entities within those networks due to (1) direct or indirect relationships between the networked entities themselves and (2) the increased possibility of hostile attackers being present within the system

bull Due to the emergence of client-side attacks and other threats the (human) end users of

networked resources are now an important part of that networkrsquos total security defense posture Aircraft have limited control over the computer and network behavior of their Internet-connected passengers NAS employees as well as aircraft crew members must be trained to ensure that their own computer behavior does not inadvertently enable attacks against the aircraft This has direct security implications to both the airborne systems themselves as well as to those networks with which the aircraft connects

bull Entities within networks that are directly or indirectly connected to the Internet may

possibly be accessible by attackers located elsewhere in the Internet despite the presence of intervening security firewalls This implies that more than one billion people may (theoretically) potentially have access to aircraft

bull The Internet has experienced many well-documented instances of hostile attacks

affecting the integrity of computers networked systems and the data and services they support

bull COTS computer systems have an indeterminate number of latent bugs that can be

attacked bull COTS computer systems cannot be adequately secured within large network

environments in general because their security controls cannot be trusted to perform as intended when attacked They represent possible footholds that attackers can compromise and use as a base from which to attack other networked entities

bull Security vulnerabilities including those stemming from deploying COTS devices or

systems can theoretically be mitigated However the viability of those mitigation approaches are themselves suspect to the extent that they rely upon COTS systems for their implementation This is because COTS software and systemsmdashand the functionality they supportmdashare not trustworthy when attacked

12

bull The security viability of current networked systems is partially a direct function of the network and system management (including configuration management) expertise of its administrative personnel

bull The protocols of the IP family can be secured but their cumulative underlying key management system is ad hoc and complexmdashwith direct configuration and management implications

bull The IP familyrsquos network management system including its underlying simple network

management protocol version 3 (SNMPv3) protocol has questionable security viability when used in network environments that have large numbers of devices built by many different vendors

bull Whenever different security administrations or technologies are joined together in a

cooperative manner (eg aircraft and ground systems) it is important and challenging to define the interfaces between the systems in such a way that a diminished security posture for the combined system as a whole does not result

This report describes assurance mechanisms to mitigate these threats However the mitigation system has one key missing element (see section 72) Until that element has been successfully addressed no networked system can currently be guaranteed to be as safe or as secure as the currently deployed non-networked airborne systems 22 WHY BOTH TARGET ALTERNATIVES HAVE SIMILAR SECURITY POSTURES

It was mentioned that the architecture in figure 3 is more secure than the architecture in figure 1 However both alternatives have similar security postures such that the same network solution which is described in section 83 addresses the security and safety requirements for both target alternatives Figure 4 shows that both target alternatives similarly expose onboard aircraft systems to possible attacks from the worldwide Internet infrastructure for the reasons explained in section 41 While the air gap between passenger and avionics equipment of figure 3 (see bottom of figure 4) protects avionics systems from being directly attacked intra-aircraft from the passenger network they are still theoretically exposed to remote passenger or Internet attack via the NAS

13

Aircraft

World wide Internet Infrastructure

Air Gap in Aircraft Alternative No Air Gap in Aircraft Alternative

ControSit

NAS Both target approaches are - based threatsexposed to Internet

Second approach is somewhatmore secure than the first buthas greater size weight andpower (SWAP) requirements

Risk mitigation controls are very similar for both targets

Both targets use the same proposed target network architecture design Aircraft

Worldwide Internet InfrastructureAir Gap physically separates passenger communications from avionicscrew communications

avionic

passengers

NAS

Figure 4 Both Target Architectures Have Similar Security Profiles

Consequently the primary advantage of the target approach shown in figure 3 versus the target approach shown in figure 1 is that the figure 3 approach enables the port 80 (ie hypertext transfer protocol (HTTP)) overt channel to be closed within the aircraftrsquos perimeter defense firewall (see section 835) thereby eliminating a vulnerability by which firewall protections can be circumvented There are also two helpful secondary affects of the figure 3 approach bull The packet filter design (see section 834) is simplified Passenger communications of

the figure 3 approach do not traverse avionics networks Consequently the avionics network of that approach does not require that the packet filter system protect it by enforcing quality of service (QoS) provisions upon passenger communications to ensure that those communications do not consume too much avionics LAN capacity Similarly the packet filter would no longer need to ensure that passengers cannot address the encapsulation gateways (see section 833) or the cockpit (pilot) network since there would be no connectivity to those systems However the figure 3 approach still requires that the packet filter be retained to ensure that the noncockpit crew network cannot send packets to the encapsulating gateways unless those crew systems could be provided with physical security guarantees that they are never accessible to passengers

bull The high-assurance LAN (see section 837) is similarly simplified because it no longer

must be deployed in a manner to ensure that the passenger network can only access other avionics systems by means of the packet filter Rather different physical LAN systems must be used by the passenger system and the rest of the aircraft

Consequently the figure 3 approach does not eliminate the need to deploy a packet filter within the aircraft but it does simplify what that packet filter system does However the figure 3

14

alternative requires that parallel (ie distinct) sets of onboard networks and wireless external communications systems be created one for passengers and one for the other aircraft systems The figure 3 approach therefore has a higher SWAP overhead than the figure 1 approach by requiring parallel internal (onboard LAN) and external network (radio satellite etc) connectivity without significantly improving the security profile for the aircraft itself 3 EXTENDING THE CURRENT FAA CERTIFICATION ENVIRONMENT

The purpose of this section is to provide an orientation for how this study recommends that the certification environment be extended to handle networked airborne LANs The specific theory rationale and process underlying this studyrsquos recommendations are explained in subsequent sections (ie sections 6 7 and 8) It was previously mentioned that current FAA and civil aviation safety assurance processes for airborne systems are based on ARP 4754 ARP 4761 and the ACs FAA software assurance is based on compliance with DO-178B and complex electronic hardware design assurance is based on DO-254 The primary FAA certification standards are the respective regulations FAA policy and the ACs This study addresses how to extend these processes and certification environment to include networked airborne LANs in a mathematically viable manner Because of the large scope of the current FAA policies and processes this report addresses this larger task by explaining how to specifically extend its airborne software assurance subset Figure 5 shows a simplified and abstracted view of the current FAA software assurance approval process It shows that airborne software is currently developed and approved primarily according to the guidance and processes described within DO-178B2 When individual software items are combined into integrated or complex systems then additional safety considerations apply which are documented in ARP 4754 These considerations address integration issues and system vulnerabilities that may arise from system dependencies ARP 4754 refers to each element within that system as being an item This same terminology is adopted by this study DO-178B builds upon system design concepts such as the AC 251309-1A fail safe design concepts one of which is integrity Both DO-178B and ARP 4754 (ie section 222 of DO-178B where it is called the ldquosoftware level definitionsrdquo and Table 3 of ARP 4754) rely upon the same five failure condition categories Indeed the same failure condition categories are consistently used within other civil aviation documents as well (eg Table 2-1 of DO-254 and Table 1 of ARP 4761) Different development processes are applied to items classified in different failure condition categories so that items classified in the more severe safety failure conditions are developed by more extensive processes that produce higher assurance results For software items this is reflected in the DO-178B software level definitions For this reason this report refers to DO-178B software levels as reflecting safety assurance levels

2 There are other applicable policies and guidance in addition to DO-178B that can also be applied Please recall

that this figure is a simplified abstraction

15

Stand-alone Software System

ComplexSoftware

ComplexSoftware

ComplexSoftware

1) Stand alone software systemFocuses on that software entity (DO-178B)

2) Integrated or Complex SystemsAddresses each software Item (DO-178B) as well as the potentially complex affects resulting from their integration together (ARP 4754)

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

3) Networked Airborne LANsA complex system in which every entity in the same network (ie the LAN and whatever the LAN directly or indirectly connects to) is inadvertently integrated togetherregardless of the functional intent of the system design

Processes must now also address possible networkinteractions during (and resulting from) network attacks

Fate sharing any compromised network entity can theoretically be used to attack other networked entities or their shared network environment

Other connectedLANs andNetworks

Finite Number of Entities Concerned with effective integration techniques

Concerned with fate sharing in a hostile environmentArbitrarily Huge Number of Entities

Figure 5 Three Different Software Certification Environments

ARP 4754 is directly concerned with architectural considerations that pertain to highly integrated or complex airborne systems

ldquoSystem architectural features such as redundancy monitoring or partitioning may be used to eliminate or contain the degree to which an item contributes to a specific failure condition System architecture may reduce the complexity of the various items and their interfaces and thereby allow simplification or reduction of the necessary assurance activity If architectural means are employed in a manner that permits a lower assurance level for an item within the architecture substantiation of that architecture design should be carried out at the assurance level appropriate to the top-level hazard hellip It should be noted that architectural dissimilarity impacts both integrity and availability Since an increase in integrity may be associated with a reduction in availability and vice-versa the specific application should be analyzed from both perspectives to ensure its suitabilityrdquo (Quoted from Section 541 pages 25 and 26 of reference 1)

Because ARP 4754 addresses possible system vulnerabilities that derived from creating functional system relationships between items to a certain degree it can be characterized as being directly concerned with effective integration techniques between those system items It therefore presumes that the regulator can correctly identify the items that comprise a system as well as their mutual relationships together

16

Aircraft network security is a systems issue System development (ARP 4754) in conjunction with the system safety assessment process (ARP 4761) is responsible for defining network accesses vulnerabilities detection and protection requirements Some of the vulnerabilities will be mitigated by limiting and controlling access by using hardware and software capabilities Some identified vulnerabilities will be mitigated by monitoring and detection capabilities The security protection should be defined by the system and then by appropriate system requirements allocated to hardware software and hybrids This study assumes that best current IA practice will be followed including deployment of traditional IA security controls when appropriate After implementation these protections mitigations and monitoring will also likely be verified and validated at the system level as well Consequently aircraft network security is an ARP 4754 issue However approving networked systems in some ways should be recognized as being a significant extension to ARP 4754 Networked systems differ from the current ARP 4754 environment in several significant ways Networked elements are systems that include all of the networks and their constituent elements and users to which the network is directly or indirectly attached Networks are therefore arbitrarily huge and the many interrelationships of the system items are often too subtle to discern Networks are inherently complex systems in which every item in the network is inadvertently integrated regardless of whether those items share any common functional goal Approval of networked entities must now also address possible network interactions that occur during and result from network attacks The various networked elements potentially have a fate sharing relationship with each other because any compromised network entity theoretically can be used to attack other networked items or their shared network environment Therefore networked airborne LAN environments are inherently ldquohighly integrated or complex aircraft systemsrdquo with attributes that extend the complex relationships for which ARP 4754 was created Section 4 and appendix A will introduce some of the risks that characterize networked systems and underlie the following observations bull In networked environments ARP 4754 needs to be extended to consider each item within

the LAN to be integrated even if that item has no functional relationship with anything else For example

- If the LAN experiences a successful denial of service (DoS) attack then each

networked item in that LAN may potentially be unable to fulfill its function Therefore ARP 4754 must be extended in networked environments to ensure availability

- If an item in the LAN becomes hostilely compromised by an attacker then it

potentially can be used by that attacker to attack the network itself or other items on the LAN Therefore ARP 4754 must be extended in networked environments to address LAN and item integrity To ensure LAN and item integrity ARP 4754 needs to be extended to require verifiably secure software installation procedures as well as mechanisms to ensure the continued integrity of deployed items and systems

17

bull If airborne LANs are connected into networks then the cumulative network system has

similarly become integrated and existing safety processes need to become extended to each system and item within that larger networked system if they are to remain viable even if any component element within the larger system never itself becomes airborne

bull If the network has both device and human users then ARP 4754 must also become

extended to also pertain to humans Every human or device with access to that network is a potential threat to that network and may potentially initiate attacks against the network itself the LANs or subnetworks that comprise that network of the items located within that network If the network is directly or indirectly connected to the Internet then there are theoretically more than one billion humans with potential access to that airborne LANmdashdespite the presence of intermediate firewalls This means that mechanisms are needed within networked systems so that human behavior cannot deprecate historic DO-178B and ARP 4754 safety assurances

This study identifies mechanisms by which ARP 4754 can be extended to address networking requirements by strategically introducing integrity and availability security controls It does this by building upon a mathematically based security model that can extend ARP 4754 concepts into arbitrarily vast and complex network systems This study uses proven SSE processes to combine these concepts and controls into the exemplar network architecture (see section 8) This study is also similarly concerned with extending DO-178B so that highly assured software items within networked environments can be developed and assured to mitigate known network risks The concept of highly assured software in networked environments explicitly means that the software can be trusted to behave in the same fashion before during and after attacksmdashsomething that current DO-178B processes cannot ensure because they do not explicitly address network attack threats Consequently current DO-178B software in networked environments may behave in an indeterminate manner during or after attacks if latent bugs within the software itself are successfully attacked by exploits that violate its integrity Such software is a potential threat to its deployment environment It is potentially subject to misbehavior corruption or compromise potentially including becoming used as a launching pad to attack other systems and items This issue is addressed in section 72 This study does not provide suggestions for the process by which the FAA or the worldwide civil aviation community may choose to respond to these recommendations It may be that the relevant experts may conclude that the revision of ARP 4754 and DO-178B that this study presumes is an unacceptably long term or unreliable approach for ensuring that network security concerns are adequately addressed in a timely manner If so then it is conceivable that the FAA may decide to produce an airborne network system security assurance policy in the near term If this is done then if SAE and RTCAEUROCAE subsequently decide to address this issue in the future then that initial policy could be revised to reflect their proposal

18

4 NETWORK RISKS

This section specifically discusses network security issues that are directly relevant to airborne safety and security within networked environments Two papers authored by Daniel Mehan [18 and 19] the former FAA Chief Information Officer (CIO) provide an important context for the material discussed in this section These papers describe the cumulative processes needed to create a secure and safe NAS environment These processes are partially summarized in figure 6 The majority of the topics covered in this section directly focus on network system aspects of ldquoCyber Hardening of System and Network Elementsrdquo shown in figure 6 of a total protection system Many other aspects of NAS safety and security are not addressed within this section and are only briefly addressed by this study

PersonnelSecurity

PhysicalSecurity

Cyber Hardening ofSystem and Network Elements

Compartmentalization

RedundancyArch

itectu

re a

nd E

ngine

ering

Awareness and Execution

Figure 6 The FAA Five Layers of System Protection [18]

Reference 20 also provides very helpful concepts and background information for the aircraft network safety and security topics presented in this section and appendix A It is important to recognize that network threats are always evolving An indeterminate number of network threats exist These network threats can mutate quite rapidly For example the following is an example of a current network threat that did not exist the year before this study was written

ldquoFile encrypting Trojans are becoming so complex that security companies could soon be powerless to reverse their effects a new report from Kaspersky Lab said

19

The report notes the rapid evolution of the public key encryption used by one family of crypto malware Gpcode which went from using 56-bit to 660-bit RSA [encryption key] in a matter of weeks Commonly termed lsquoransomwarersquo Trojans that encrypt data files on a userrsquos [personal computer] PC before demanding a payment in return for supplying the key to unlock the files have come from nowhere in recent months to become a measurable problem At the time of its discovery in June [2006] Gpcodeag ndash which used a formidable 660-bit key ndash Kaspersky described the process required to decrypt such a key as equivalent to setting a 22 GHz PC to work for thirty yearsrdquo (Quoted from reference 21)

Defenses that require a response to each new threat instance as it appears are both expensive and of questionable efficacy The best mechanism to effectively constrain the impact of these threats over time is to create a very solid safety and security foundation for both the NAS and aircraft Figures 7 and 8 were created by David Robinson [22] to indicate the possible threat affects that can occur when networked aircraft becomes successfully attacked These types of threats cannot occur for aircraft whose aviation systems are not attached to network systems

ldquoThese new generation aircraft [eg B787 A370 A350 BY-1] will include a new aircraft data network design which will introduce new cyber security vulnerabilities to the aircraftrdquo [22]

Unless properly mitigated any networked aviation system is potentially subject to the following range of impacts should they be successfully attacked

20

General Threat

Identifiers Aircraft Data Network Threats

Aviation Infrastructure Mission and Operational

Impact FAILURE Safe state of the aircraft system could

be compromised in the event of a security penetration

Access to the flight controls by unauthorized individuals affecting safety

DENIAL Aircraft system resources exhausted due to denial of service attack system error malicious actions

Critical services disrupted by system overload or traffic jamming

Access Control

Individual other than an authorized user may gain access to the aircraft system via phantom controller masquerade or spoofing system error or an attack for malicious purposes

Unauthorized Access

Passive Attack

Snooping or eavesdropping compromising security (misdirection) Design Flaws may lead to back door access

Unauthorized corruption or destruction of data causing unsafe flight conditions

Figure 7 Network Threat Mission and Operational Impact [22]

Threat Targets Threat Effects

Aircraft Operation Serious degradation or loss of mission capability airline is not able to perform its primary function

Assets Major damage to airline assets Financial Major financial loss Human Serious or catastrophic physical harm to individuals Public Perception Total loss of confidence in air traffic by passengers

disclosure of security information

Figure 8 Airborne Network Threat Targets [22]

The subsequent sections describe technical mechanisms to mitigate these risks 41 DIFFERENT UNIVERSES STAND-ALONE VERSUS NETWORKED

It is commonly recognized that the safety and security assurance properties of stand-alone systems are much more easily ascertained than the assurance of systems within networked environments This difference is primarily due to the fact that the assurance of stand-alone entities is a function of the inherent design of that system itself These include the repertoire of issues currently considered by DO-178B such as hardware and software design input-output direct memory access interrupt and interrupt processing design and development process controls operating system (OS) issues and security modes The assurance of networked systems by contrast is a function of not only that systemrsquos own internal design and processes

21

but also the implications of the effects to its design and operation caused by the other elements within the total system as a whole As Joel Knight has observed

ldquoUnless a system is entirely self contained any external digital interface represents an opportunity for an adversary to attack the system It is not necessary for an adversary to have physical access Of necessity many systems will communicate by radio and digital radio links present significant opportunities for unauthorized accessrdquo [7]

A great many issues partially determine the susceptibility of any networked item to possible attacks bull To what extent is an entity manageable If it is manageable how secure is the identity

authentication authorization and access control processes imposed upon administrative personnel and processes (eg separation of duties with least privilege)

bull To what extent is the entity configurable If it is configurable what controls ensure that

it is configured correctly bull How confident (eg assurance level) is the designer certifier and designated approving

authority (DAA) that there is a total absence of latent software bugs that can be attacked by hostile attackers to create safety threatening affects

bull How impervious is the implementation to attacks originating from other devices

including how dependent is the implementation upon inherent network availability or security attributes

bull How dependent is the entity upon other distributed components Can their misbehavior

result in safety threatening scenarios bull What is the relative security and integrity assurance of the data communications

protocols and underlying network media (including networking devices) used within that network infrastructure

The potential interaction of these networked elements is complex The possible complexity of these interactions is a partial function of the number of elements within the total system and the number of possible interaction mechanisms Some possible interactions can be unintended and subtle For example a system can be assured as being safe in a controlled environment using DO-178B processes However is this assurance still viable if that system is transplanted into a highly networked environment where unforeseen processes may try to influence it in unanticipated ways Will a real-time system perform adequately in environments where it is continually being accessed by a rogue process Even if the rogue process fails all authentication and authorization attempts can it still consume enough central processing unit (CPU) or network capacity

22

resources so that the required real-time interactions of that system with its legitimate peers are detrimentally impacted A basic attribute of network environments is that risks to elements within that system increase in direct relationship to the networkrsquos population size The larger the community of networked devices the greater the possibility that at least one of those devices has been constructed with latent bugs that can be leveraged to compromise that device to directly or indirectly attack other parts of the system Also the larger the community of humans that can access elements within the total network system the greater the possibility that at least one of those humans will exploit bugs either intentionally (maliciously) or accidentally Hostile electronic attacks may be conducted by both the corrupted insider (eg insider threat) as well as by unauthorized personnel who have leveraged system or process blemishes to gain unauthorized (remote) entry into the system It can also occur by means of accidental mistakes made by authorized personnel Widely used COTS network equipment such as Internet technologies is more easily assembled into large network systems than less popular communications technologies For example the Aeronautical Telecommunications Network (ATN) which is used for air traffic management systems today is built using open system interconnect (OSI) protocols OSI protocols are rarely deployed today except within specialized niche environments Because of this it is comparatively difficult to link ATN systems with other networks to create large network communities IP systems by contrast are ubiquitously deployed today Because of this it is comparatively easy to link together IP-based systems with other networks to create large network environments A key point to recognize is that just because an IP-based system is not connected to a large network environment today does not mean that it cannot easily be connected into a large networked environment tomorrow perhaps inadvertently For example inadvertent exposure of allegedly stand-alone (ie physically isolated via an air gap) IP networks to remote Internet-based attacks have occurred many times in real life by means of inadequately secured modems located within those allegedly isolated networks Widely deployed public networks have larger populations of users than small private networks The more people within the networking community the greater the probability that one or more of them may pose an attack risk to the elements within the system The larger the cumulative number of users within any aspect of the network the greater the possibility is that a user may purposefully or accidentally exploit those weaknesses in a detrimental manner The inclusion of the words ldquoaspect of the networkrdquo in the previous sentence is a reference to a technical point that is partially explained within appendix A That point is that in large network-of-network systems such as the worldwide Internet network access control defenses are established between discrete network administrative entities by means of security firewalls [23] Firewall technologies have significantly improved over time Unfortunately so has the sophistication of attacks against them A class of exploits3 exist that may possibly circumvent the access control protections of firewall systems Should these attacks succeed then those attackers could access network systems where they are not authorized

3 eg fragmentation attacks time-based attacks HTTP-based (Port 80) attacks and other emerging exploits

23

Specifically most networks implement firewall policies that permit remote access into the autonomous systems (AS) they protect through a port 80 (ie HTTP) overt channel Consequently many sophisticated attacks explicitly leverage the policy weakness that enables this overt channel to penetrate firewall systems Only a small percentage of currently deployed networks today have closed port 80 Even when administrative policy permits this vulnerability to be closed the efficacy of correctly configured firewalls using the very best technology can be circumvented by client-side attacks (see section 42) or improper configuration of other system elements (eg modems) Also firewalls that are deployed in SWAP-constrained environments (eg aircraft) are often susceptible to a range of modern attacks (eg fragmentation attacks time-based attacks) because they may not contain the necessary resources (eg CPU or RAM) to handle those attack vectors Consequently firewall protections can potentially be circumvented Firewalls therefore need to be part of a larger defense-in-depth system (see section 51) which needs to provide redundant protections (eg virtual private networks (VPN) see section 56)) to supplement the firewall in case its protections are circumvented In view of this potential danger the number of people that can access a network should not be equated to the number of people that are authorized to access that network Rather it should be considered to be the total number of people that can access any part of the larger network system in which that network is a part This explicitly includes users that are solely authorized to access another network to which onersquos own network is only indirectly connected Consequently if airplanes are even indirectly connected to the Internet then theoretically there are over one billion people that can potentially access entities within that airplane 42 INTERNAL EXTERNAL AND CLIENT-SIDE ATTACKS

Because networked systems traditionally use perimeter defense mechanisms (security firewalls) to limit access to internal network resources a distinction has been created between insiders and outsiders An insider is an individual who is authenticated and authorized to use internal network resources regardless of whether or not they are physically located geographically in the same location as the networked resource Outsiders are not authorized to have such access A large percentage of security controls have historically been centered on repelling security attacks from outsiders This reflects the fact that insiders usually undergo scrutiny to obtain their authorizations However higher assurance environments need to consider the possible threats stemming from corrupted insiders (ie the insider threat) These environments need to deploy controls so that the activities of all authorized users inside the network are restricted in terms of separation of duties with least privilege Unfortunately an entirely new class of attack the client-side attack has become increasingly popular and dangerous Client-side attacks include inadvertent exposure to hostile e-mail attachments or accesses to malicious web pages containing executables or scripts that allow arbitrary code to run In both cases the attacker leverages latent security vulnerabilities within the userrsquos web browser or e-mail client

24

ldquoWith the rise of client-side attacks a flaw emerges in the old [security] model despite avoiding a direct connection to the outside users might still be attacked by the very services that theyrsquove requestedrdquo [24] ldquoA new attack vector has been created in which users are transformed into a platform to attack internal resources without their consent or even their awareness Users are no longer passive participants in the security model theyrsquove become the very service by which entrance is gained into the protected interior of the networkrdquo [16]

There are many published examples of successful client-side attacks including the following

ldquoThe Oregon Department of Revenue has been contacting some 2300 taxpayers this week to notify them that their names addresses or Social Security numbers may have been stolen by a Trojan horse program downloaded accidentally by a former worker who was surfing pornographic sites while at work in January [2006] An investigation by agency security personnel and the Oregon State Police found that the malicious program was designed to capture keystrokes on the former employeersquos computer hellip The employee was an entry-level worker who was assigned to enter taxpayer name and address changes as well as some social security numbers lsquoWe know that the information that the Trojan gathered up was transmitted outside of the agencyrsquo to an unrelated Web site The incident is still under investigationrdquo [25]

Therefore attacks against networked entities may occur from outsiders from corrupted insiders as well as from client-side attacks (see figure 9) The effect of outsider attacks is to emphasize perimeter defense protections (eg firewalls VPNs) The effect of corrupted insiders is that network security is no longer primarily a function of establishing adequate perimeter defense controls it now must also include viable access control within the network itself The effect of client-side attacks is that network security is no longer solely a function of the total control protections established on devices within the network It is now also reliant upon the appropriate activities of every human using those network resources While filtering services located at the perimeter defense firewalls can and do combat client-side attacks however new attacks are continually being devised that perimeter defense filtering systems must be updated to identify and eliminate Consequently there is often a vulnerability window between when a new attack type has been devised and when the protections against that new attack have been deployed For this reason defense against client-side attacks heavily relies upon end-user educationmdashand can be circumvented by end-user mistakes

25

bull Corrupted or Careless Insiderbull Are authorized to access the networkbull Eg NAS personnel aircraft personnel or passengers local systems

bull Hostile Outsiderbull Are not authorized to access the networkbull May be located on ldquothe Internetrdquo

bull Client-side Attacksbull Malicious software lurking in ldquoneutralrdquo environments (eg email web

sites other) bull The historic distinction between ldquodatardquo and ldquocoderdquo is vanishingbull NAS personnel aircraft personnel and aircraft passengers may be duped

into inadvertently executing and thereby introducing malicious software into the network

bull Network users therefore have become an integral element of a networkrsquos security defenses

Figure 9 Threat Agents in a Networked Environment

This topic will resume in section 44 when the implications of mixing embedded systems and generic OSs within the same network will be discussed Before that discussion can occur however it is first necessary to discuss the vulnerabilities that exist within a networked environment 43 COMMERICIAL OFF-THE-SHELF VULNERABILITIES IN A NETWORKED ENVIRONMENT

While this section specifically addresses well-known COTS vulnerabilities in networked environments similar problems may or may not exist within embedded avionics systems depending upon whether latent bugs exist within those systems that can be exploited by network attacks Lance Spitzner has gathered together the following statistics which provide partial evidence that the worldwide Internet infrastructure is a very dangerous place bull ldquoAt the end of the year 2000 the life expectancy of a default installation of Red

Hat 6 a commonly used version of Linux [a computer OS] was less than 72 hours

bull One of the fastest recorded times a honeypot [ie a device deployed in order to

study the behavior of electronic attackers] was compromised was 15 minutes This means that within 15 minutes of being connected to the Internet the system was found probed attacked and successfully exploited by an attacker The record for capturing a worm was under 90 seconds

26

bull During an 11-month period (April 2000-March 2001) there was a 100 percent increase in unique scans and an almost 900 percent increase in Intrusion Detection Alerts based on Snort [an Intrusion Detection utility]

bull In the beginning of 2002 a home network was scanned on average by 31 different

systems a dayrdquo [26] This list can be supplemented by many other data points including bull ldquoThe most virulent [computer] virus to date infected several million machines in

about 20 minuteshelliprdquo [15] bull ldquoWhen we put this [honeypot] machine online it was on average hit by a

potential security assault every 15 minutes None of these attacks were solicited merely putting the machine online was enough to attract them The fastest an attack struck was mere seconds and it was never longer than 15 minutes before the honeypot logged an attempt to subvert it hellip

bull At least once an hour on average the BBC honeypot was hit by an attack that

could leave an unprotected machine unusable or turn it into a platform for attacking other PCs hellip

bull By using carefully crafted packets of data attackers hope to make the PC run

commands that hand control of it to someone else Via this route many malicious hackers recruit machines for use in what is known as a botnet This is simply a large number of hijacked machines under the remote control of a malicious hackerrdquo [27]

bull ldquoIronPort recently published a report showing that Trojan horses and system

monitors ndash two of the most serious types of malware ndash infect one out of every 14 corporate PCs That means that in an organization of 1000 desktop PCs there is an average of 70 computers that represent a major security risk hellip Dwarfing Trojans and system monitors are less serious types of malware such as adware and tracking cookies which infect 48 and 77 of PCs respectivelyrdquo [28]

bull ldquoThe number of new [COTS] software security vulnerabilities identified by

security experts hackers and others during the first eight months of this year [2006] has already exceeded the total recorded for all of 2005 according to Internet Security Systems Vulnerabilities through September have reached 5300 leaping past the 5195 discovered for all of 2005 says Gunter Ollmann director of the X-Force research group at ISS lsquoEight hundred seventy-one were found to affect Microsoft operating systems while 701 vulnerabilities were only found to affect Unix operating systemrsquo Ollmann says But many vulnerabilities cross platform

27

boundaries to affect them all including Linux About 3219 vulnerabilities fall into that realm Ollmann notes ISS ranks vulnerabilities as critical high medium and low Of the 5300 vulnerabilities recorded for 2006 so far 04 percent were deemed critical (could be used to form a prolific automated worm) 166 percent were deemed high (could be exploited to gain control of the host running the software) 63 percent were medium (could be used to access files or escalate privileges) and 20 percent were low (vulnerabilities that leak information or would allow a denial-of-service attack) hellip lsquoOf the 5300 vulnerabilities hellip 876 percent could be exploited remotely 108 percent could be exploited from the local host only and 16 percent could be exploited remotely and localrsquordquo [29]

The Computer Emergency Response Team4 (CERT) coordination center keeps a monotonically increasing list of reported Internet-related security incidents dating from 1988 to 2003 inclusive5 These statistics show that there was more than a 100 percent increase in reported security incidents in 2001 increasing from 21756 in 2000 to 52658 in 2001 The most recent incidents were publicly disclosed in 2003 which had 137529 different reported security incidents As the CERT notes ldquoan incident may involve one site or hundreds (or even thousands) of sites Also some incidents may involve ongoing activity for long periods of timerdquo [30] The CERT ceased reporting the number of security incidents after 2003 because ldquoGiven the widespread use of automated attack tools attacks against Internet-connected systems have become so commonplace that counts of the numbers of incidents reported provide little information with regard to assessing the scope and impact of attacks Therefore as of 2004 we will no longer publish the number of incidents reportedrdquo [30] An example of an undisclosed incident occurring since 2003 is the following

ldquoChinese hackers launched a major attack on the UK Parliament earlier this month the governmentrsquos e-mail filtering company MessageLabs Ltd has confirmed The attack which occurred on Jan 2 [2006] attempted to exploit the Windows Metafile (WMF) vulnerability to hijack the PCs of more than 70 named individuals including researchers secretaries and members of Parliament (MP) themselves E-mails with an attachment that contained the WMF-exploiting Setabortproc Trojan horse were sent to staffers Anyone opening this attachment would have enabled attackers to browse files and possibly install a key logging program to

4 CERT see httpwwwcertorg 5 See httpwwwcertorgstatscert_statshtml

28

Technical Report Documentation Page

1 Report No

DOTFAAAR-0831

2 Government Accession No 3 Recipients Catalog No

4 Title and Subtitle

NETWORKED LOCAL AREA NETWORKS IN AIRCRAFT SAFETY SECURITY AND CERTIFICATION ISSUES AND INITIAL ACCEPTANCE CRITERIA (PHASES 1 AND 2)

5 Report Date November 2008

6 Performing Organization Code

7 Author(s)

Eric Fleischman Randall E Smith and Nick Multari

8 Performing Organization Report No

9 Performing Organization Name and Address

The Boeing Company PO Box 3707 MC 7L-49 Seattle WA 98124-2207

10 Work Unit No (TRAIS)

11 Contract or Grant No

DTFACT-05-C-00003

12 Sponsoring Agency Name and Address

US Department of Transportation Federal Aviation Administration Air Traffic Organization Operations Planning Office of Aviation Research and Development Washington DC 20591

13 Type of Report and Period Covered Final Report December 2004-December 2006

14 Sponsoring Agency Code AIR-120

15 Supplementary Notes

The Federal Aviation Administration Airport and Aircraft Safety RampD Division Technical Monitor was Charles Kilgore 16 Abstract

This report presents the results of the Federal Aviation Administration (FAA) local area network (LAN) research effort addressing potential safety impacts introduced by LANs in aircraft Interconnecting previously isolated components on aircraft increases the complexity of unintended interactions between components and provides potential new access points that could be exploited to cause harm This report addresses the potential security vulnerabilities introduced by networking LANs the safety affects of security failures and a process for designing and certifying LANs on aircraft to ensure the safety of these new aircraft systems This report extends the current FAA safety assurance processes into airborne networked environments by leveraging the Biba Integrity Model It builds upon existing FAA studies that articulate mechanisms to integrate RTCADO-178B and common criteria processes for the National Airspace System This approach creates a safety-oriented airborne networked architecture that is built upon existing DO-178B and Aerospace Recommended Practice 4754 safety mechanisms This produces results that are a direct analog to existing US Department of Defense policies and processes 17 Key Words

Local area network Network Aircraft safety Aircraft security

18 Distribution Statement

This document is available to the US public through the National Technical Information Service (NTIS) Springfield Virginia 22161

19 Security Classif (of this report) Unclassified

20 Security Classif (of this page) Unclassified

21 No of Pages 204

22 Price

Form DOT F 17007 (8-72) Reproduction of completed page authorized

TABLE OF CONTENTS Page EXECUTIVE SUMMARY xiii 1 INTRODUCTION 1

2 OBJECTIVES AND APPROACH 7

21 Notional Networked Aircraft Architecture 9 22 Why Both Target Alternatives Have Similar Security Postures 13

3 EXTENDING THE CURRENT FAA CERTIFICATION ENVIRONMENT 15

4 NETWORK RISKS 19

41 Different Universes Stand-Alone Versus Networked 21 42 Internal External and Client-Side Attacks 24 43 Commerical Off-the-Shelf Vulnerabilities in a Networked Environment 26 44 Mixing Embedded Systems and Generic Operating Systems 31 45 Internet Protocol Family Security 35 46 Network ManagementmdashNetwork Security Concern 43

461 The SNMP has no Provisions for Two-Factored Authentication 44 462 The SNMP Symmetric Keys may be Assembled From Passwords 44 463 The SNMP Key Updates do not Provide for Perfect Forward Secrecy 45 464 The SNMP Symmetric Key Distribution Problems 45 465 The SNMP Currently Lacks Demonstrably Viable Session Keys 46

47 Mixing Different Communication Protocol Systems 46

471 Significant Semantic Differences to Allegedly Similar Concepts 48 472 Integrating Dissimilar Protocol Families 48

48 Identity Problem 50 49 Integrated or Cooperating System of Systems 51

5 NETWORK SECURITY DEFENSES 52

51 Defense-in-Depth 52 52 Department of Defense Networking 55 53 Internet Protocol Topology Hierarchy and Policy Systems 58 54 Mechanisms to Connect Aircraft to Networks 59

541 Aircraft and Network Mobility 60

iii

542 Aircraft as a Node (MIP and MANET) 60 543 Multilevel Network Systems (RED-BLACK VPN) 61

55 Airplane Routing and Autonomous Systems 62 56 Virtual Private Networks Enable Network Partitioning 66 57 Security Zones and Policy-Based Networking 69

6 RELATING SAFETY AND SECURITY FOR CERTIFICATION 73

61 Security Requirements of Airborne Networked Environments 74

611 Integrity 75 612 Availability 77 613 Authentication 78 614 Confidentiality 79 615 Nonrepudiation 79

62 Extending FAA Orders Guidance and Processes Into Vast Network Systems 79 63 Comparing Civilian Aircraft Safety and Federal Government Security Levels 83

631 Civil Aircraft Software Levels 83 632 Federal Government Security Classifications 85 633 Comparison of the Two Policy Systems 86

64 Biba Integrity Model and Bell-LaPadula Confidentiality Model

are Direct Analogs 87

65 Relating Safety Classification Levels to the CC 90 7 EXTENDING FAA CERTIFICATION TO AIRBORNE NETWORKS 93

71 Extending ARP 4754 Into Networked Environments 94 72 Extending DO-178B Into Networked Environments 96

8 CANDIDATE SAFETY AND SECURITY NETWORK SOLUTION 98

81 System Security Engineering Methodology 99 82 Applying the SSE Methodologies to Airborne Networks 102 83 Exemplar Airborne Network Architecture Solution 105

831 The VPN Encapsulation Method 108 832 Physical Security 114 833 Encapsulation Gateways 115 834 Packet Filter 116 835 Firewall 117 836 The ASBR Router 117

iv

837 High-Assurance LAN 118 838 Quality of Service 118 839 Air-to-Ground and Air-to-Air Communications 118

84 Network Management Extensions 119

9 ANSWERS TO THE PHASE 1 QUESTIONS 122

91 Connection of Multiple Domains 122

92 Integrated Modular Avionics Implementation 123

93 Using Public IPs 125

94 Electronic Flight Bags 125

95 Updating Security Protection Software 127

96 Responding to Security Breaches 128

97 Access to Aircraft Data 129

98 Adequacy of Existing Regulations 129

99 Ground-to-Air Communication 130

910 What is the Efficacy of Cyclic Redundancy Checks With Respect to Security 130

10 ANSWERS TO THE PHASE 2 QUESTIONS 131

101 Are Current Regulations Adequate to Address Security Concern 131

102 How Does Security Assurance Fit Into Overall Certification Process 132

103 What Should Network Security Assurance Process Contain to Meet XX1309 132

104 How Will Continued Airworthiness and Maintenance be Addressed 134

105 How Can it be Ensured That Networked Systems Cannot Impact Safety 135

106 What Should the Process be for Updating Security Protection Software 135

107 How can Security Breaches be Handled 136

11 SUMMARY 137

v

111 Findings and Recommendations 139 112 Topics Needing Further Study 147

12 REFERENCES 148

13 RELATED DOCUMENTATION 156

14 GLOSSARY 157

APPENDICES

AmdashHistoric Attack Mechanisms and Tools BmdashFAA LAN Survey Results

vi

LIST OF FIGURES

Figure Page 1 Notional Networked Aircraft Architecture 10 2 Generic Future Communication System Physical Architecture 11 3 Alternative Notional Aircraft Architecture 11 4 Both Target Architectures Have Similar Security Profiles 14 5 Three Different Software Certification Environments 16 6 The FAA Five Layers of System Protection 19 7 Network Threat Mission and Operational Impact 21 8 Airborne Network Threat Targets 21 9 Threat Agents in a Networked Environment 26 10 A Sample Deployment 30 11 Comparison Between the OSI and TCPIP Protocol Stacks 46 12 Transforming Islands of Communication Into a Single Logical Network Infrastructure 49 13 Internet Protocol Stack to Convey Legacy Protocols 50 14 Overlapping Defense-in-Depth IA Systems 53 15 Sample Defense-in-Depth Technologies 54 16 Control Life Cycle 55 17 The DoD COMSEC End-to-End Packet Flow (IPV4 Example) 56 18 Representation of how Aircraft may Function Within the GIG 57 19 Internet Protocol Topology Hierarchy 59 20 Interfaces Between Customer and Service Provider Networks 67 21 Example of VPN Encapsulation Using IPsec 68

vii

22 Customerrsquos L3VPN Protocol Stack Shown Within the Network 69 Service Providerrsquos Network 23 Historic PBN Framework 70 24 Code- and Document-Signing Process 76 25 Code- and Document-Signing Verification Process 76 26 Bell-LaPadula Confidentiality and Biba Integrety Models Compared 82 27 DO-178B Classifications Using Biba Integrity Model 89 28 Gap Analysis in the Alves-Foss et al Study 93 29 Security Engineering Process 100 30 Secure Generic Airborne Network Design (High-Level View) 106 31 How Design Addresses Network Risks 107 32 How Design Addresses Network Threats 108 33 Close-Up Detail of How Encapsulation is Accomplished 109 34 VPN Interconnecting Two Sites 110 35 Sample Airborne Network Management 120 36 Notional IMA Design (Example 1) 124 37 Notional IMA Design (Example 2) 124

viii

LIST OF TABLES Table Page 1 Internet Engineering Task Force Protocol Security Features

and Key Management Configuration 36 2 Comparison of Safety Levels to Security Classifications 86

ix

LIST OF ACRONYMS AND ABBREVIATIONS AC Advisory Circulars ACARS Aircraft Communications and Reporting System AFDX Avionics Full-Duplex Switched [Ethernet] AJ Anti-jamming ARP Aerospace Recommended Practice AS Autonomous system ASBR AS boundary router (alternatively AS Border Router) ATN Aeronautical Telecommunications Network BGP Border Gateway Protocol CA Certificate Authority CC Common criteria CE Customer edge CERT Computer Emergency Response Team CFDIU Central fault display information unit CIDR Classless interdomain routing CIM Common information model CIO Chief Information Officer CLNP Connectionless network protocol COMSEC Communications security CONOPS Concept of Operations CONS Connection-oriented network service COPS Common Open Policy Service COTS Commercial off-the-shelf CPU Central processing unit CRC Cyclic redundancy check DAA Designated approving authority DARPA Defense Advanced Research Projects Agency DEN Directory-enabled networking DHCP Dynamic host configuration protocol DMTF Distributed Management Task Force DNS Domain Name System DoD Department of Defense DoDI Department of Defense Instruction DoS Denial of service DSS Digital Signature Standard EAL Evaluation assurance level EFB Electronic flight bag EGP Exterior gateway protocol ESP Encapsulating security payload FAA Federal Aviation Administration FIPS Federal Information Processing Standard FTP File transfer protocol GIG Global information grid HAG High-assurance guard

x

xi

HMAC Hashed Message Authentication Code HTTP Hypertext transfer protocol IA Information assurance IATF Information Assurance Technical Framework ICMP Internet control message protocol IDS Intrusion detection system IETF Internet Engineering Task Force IGP Interior gateway protocol IMA Integrated modular avionics IP Internet protocol IPsec Internet protocol security IPSP Internet protocol security policy ISMS Integrated security model for SNMP ISP Internet service providers IS-IS Intermediate system to intermediate system IT Information technology L2VPN Layer 2 virtual private network L3VPN Layer 3 virtual private network LAN Local area network LDAPv3 Lightweight directory access protocol version 3 LLC Limited Liability Corporation LPILPD Low probability of interceptlow probability of detection MAC Mission assurance category MANET Mobile ad hoc networking MIB Management information base MIP Mobile Internet protocol MOSPF Multicast open shortest path first (protocol) MPLS Multiprotocol label switching MSLS Multiple single levels of security NAS National airspace system NAT Network address translator NEMO Network mobility NFS Network file system NIDS Network intrusion detection system NIST National Institute of Standards and Technology NMS Network management system NSA National Security Agency NTP Network time protocol OMT Onboard maintenance terminal OS Operating system OSI Open system interconnect OSPF Open shortest path first (protocol)

PBN Policy-based networking PC Personal computer PE Provider edge PEP Policy enforcement point PFS Perfect forward secrecy PIB Policy information base PIM-DM Protocol-independent multicast-dense mode PIM-SM Protocol-independent multicast-sparse mode PKI Public key infrastructure PPS Ports protocols and services QoS Quality of service RAM Random access memory RFC Request for comment (ie Publications of the IETF) RPC Remote procedure call RSA Rivest Shamir Addleman RTP Real-time protocol SA Security association SATS Small aircraft transportation system SBU Sensitive but unclassified SLA Service level agreement SMTP Simple mail transfer protocol SNMP Simple network management protocol SPD Security policy database SSE System security engineering SSH Secure shell (protocol) SWAP Size weight and power SYN Synchronous (bit) TCP Transmission control protocol TCSEC Trusted Computer System Evaluation Criteria TFTP Trivial file transfer protocol TLL Time to live TLS Transport layer security TP Transport layer protocol TSIG Secret key transaction authentication for DNS UDP User datagram protocol V Version VPN Virtual private network WAN Wide area network

xii

EXECUTIVE SUMMARY

This is the final report of a 2-year Federal Aviation Administration (FAA)-funded study to address security and safety issues associated with networked airborne local area networks This study consisted of two phases Phase 1 investigated the methodologies for identifying and mitigating potential security risks of onboard networks that could impact safety Phase 2 investigated techniques for mitigating security risks in the certification environment Current FAA safety assurance processes for airborne systems are based on Aerospace Recommended Practice (ARP) 4754 ARP 4761 and Advisory Circulars (AC) (eg AC 251309-1A and AC 231309-1C) FAA software assurance is based on compliance with DO-178B that guides software development processes Complex electronic hardware design assurance is based on RTCADO-254 ARP 4754 extends the DO-178B software assurance process to address the additional safety issues that arise when software is embedded into highly integrated or complex airborne system relationships Connecting airborne software within network systems represents an extension of the ARP 4754 environment to networked items that share limited common functional relationships with each other This is because networks connect entities or components of a system into a common networked system regardless of the original functional intent of the system design (eg multiple aircraft domains can be connected by a common network system) Networks are inherently hostile environments because every network user including both devices (and their software) and humans is a potential threat to that environment Networked entities form a fate-sharing relationship with each other because any compromised network entity can theoretically be used to attack other networked entities or their shared network environment Networked environments and the entities that comprise them need to be protected from three specific classes of threat agents (1) the corrupted or careless insider (2) the hostile outsider and (3) client-side attacks Because of these dangers ARP 4754 needs to be extended for networked environments by ensuring network security protection and functioncomponent availability and integrity This in turn implies the need to strategically deploy information assurance security controls within network airborne systems Safety and security have therefore become intertwined concepts within networked airborne environments Security engineering addresses the potential for failure of security controls caused by malicious actions or other means Safety analysis focuses on the effects of failure modes The two concepts (safety and security) are therefore directly related through failure effects A shortcoming of either a safety process or a security process may cause a failure in a respective system safety or security mechanism with possible safety consequences to the aircraft depending on the specific consequence of that failure Previous studies have sought to address airborne safety and security by correlating DO-178B safety processes with common criteria security processes This correlation produces necessary but inadequate results It is inadequate because it lacks mathematical rigor and therefore produces ad hoc conclusions The results are ad hoc because even when safety and security are correlated they are nevertheless distinct concepts from each other addressing very different concerns

xiii

xiv

This report states that the primary issue impacting network airborne system safety is how to extend existing ARP 4574 ARP 4761 DO-178B and DO-254 assurance guidance processes into networked systems and environments in a mathematically viable manner This study recommends that these processes can be extended into arbitrarily vast network environments in a mathematically viable manner by using the Biba Integrity Model framework This report maps current DO-178B and ARP 4754 processes into the Biba Integrity Model framework using well- established system security engineering processes to define airborne safety requirements It applies best current information assurance techniques upon those airborne safety requirements to create a generic airborne network architecture Since the Biba Integrity Model is an integrity framework it carries within itself a natural mechanism for relating safety and security concepts in terms of their respective integrity attributes Nevertheless this study recommends that the model be implemented solely within the context of existing FAA safety processes This results in airborne network systems being organized into networks that operate at specific safety levels (the DO-178B software levels) There are fortuitous secondary effects from using the Biba Integrity Model to extend current FAA processes into networked environments that stem from it being the direct analog of the Bell-LaPadula Confidentiality Model The Bell-LaPadula Confidentiality Model forms the framework for confidentiality within US Department of Defense (DoD) information processing Consequently the application of the Biba Integrity Model to airborne system assurance processes results in an airborne network architecture that remarkably resembles the emerging DoD network architecture (the global information grid (GIG)) despite their very different underlying goals Consequently the generic airborne network architecture identified by this study greatly resembles the DoDrsquos GIG architecture While military technologies could be used to implement the airborne network architecture this study recommends the use of civilian Internet protocols deployed as a virtual private network In addition the similarities between the Biba Integrity Model and the Bell-LaPadula Confidentiality Models may result in increased synergies between the DoD and FAA certification processes Deploying airborne systems into networked environments means that the FAA system safety assessment (ARP 4761) system development (ARP 4754) software assurance (DO-178B) and complex electronic hardware assurance (DO-254) processes need to be extended to address and mitigate network threats For example although security is primarily a systems concept involving system issues (eg ARP 4754) the Biba Integrity Model relies upon the networked items having integrity attributes that function at a known assurance level (ie specific DO-178B software levels) This means that the processes for developing those items for network environments should be extended to address network attack risks The concept of high-assurance software in networked environments should therefore mean that items and systems will behave in the same manner before during and after network attacks ie be immune to potential network-based threats Exploits in network environments leverage latent software blemishes so that software items are subject to misbehavior corruption or compromise possibly including

use as a launching pad to attack other systems and items Current DO-178B processes do not currently include mechanisms to identify and fix well-known network attack vectors This study identifies specific additional tests to perform that function Unfortunately software testing alone cannot result in high-assurance software This is because tests only identify the flaws for which the tests are designed to identifymdashthey cannot warrantee the absence of other flaws that were not addressed by the test suite There is no existing security theory or process that can be leveraged to produce guaranteed high-assurance results for networked environments This is a very significant certification issue Until a solution for this problem is found this study recommends that the FAA ensure that high-assurance software complies with formal models and undergoes a rigorous line-by-line code inspection to demonstrate a lack of bugs that can be hostilely attacked

xvxvi

1 INTRODUCTION

This is the final report of a 2-year Federal Aviation Administration (FAA)-funded study to address security and safety issues associated with networked airborne local area networks (LAN) This study consisted of two phases Phase 1 investigated the methodologies for identifying and mitigating potential security risks of onboard networks that could impact safety Phase 2 investigated techniques for mitigating security risks in the certification environment Individual systems onboard aircraft are designed to meet specific operational functional and physical requirements The safety requirements of a flight-critical avionics system differ from a cabin management system or a passenger in-flight Internet service If these systems become interconnected incompatibilities in design assumptions administrative policies user interaction and data security considerations increase their exposure to risk Actions taken in the context of an open passenger network (whether originating onboard an airplane or from some remote site via a network connection) must be prevented from introducing flight-safety risks to flight-critical systems Airborne systems are designed built and approved in accordance with airworthiness requirements Current FAA safety assurance processes for airborne systems are based upon Aerospace Recommended Practice (ARP) 4754 [1] ARP 4761 [2] and Advisory Circulars (AC) eg AC 231309-1C [3] and AC 251309-1A [4] FAA software assurance is based on compliance with RTCADO-178B [5] that guides software development processes Complex electronic hardware design assurance is based on RTCADO-254 [6] The primary FAA certification standards are the respective regulations FAA policy and the ACs This study addresses how to extend current FAA processes and certification environment to include networked airborne LANs in a mathematically viable manner Because of the extensive scope of the current FAA policies and processes this report addresses this larger issue by specifically explaining how to extend the software assurance subset Other aspects of FAA policy and processes can be extended into networked environments in a parallel manner (ie by leveraging a security model framework see section 62) DO-178B is one means to secure approval of airborne software The system safety assessment processes (ARP 4754 and ARP 4761) determine failure conditions of the system and define safety-related requirements as input to the software life cycle processes DO-178B identifies the software level of a software item based on the potential contribution of the software to failure conditions for the entity in question Software level refers to the worst-case result of a failure of that software upon aircraft safety in terms of one of five possible failure condition categories The failure condition categories range from failure conditions that would prevent the aircraftrsquos continued safe flight and landing (catastrophic) to failure conditions that do not affect the operational capability of the aircraft nor increase crewrsquos workload (no effect) Higher software levels and greater assurance protections are provided to entities that would have higher safety consequences should they fail DO-178B also addresses some software design and certification considerations for user-modifiable software option-selectable software commercial off-the-shelf (COTS) software and other software-related issues

1

Similar guidance is also provided for airborne electronic hardware (eg DO-254) The principals that pertain to networking airborne systems that are addressed in this report directly pertain to all networked system entities both software and hardware This reportrsquos resulting exemplar network architecture (see section 83) is therefore agnostic concerning whether the airborne networked entities are hardware software or a combination of both Historically many software entities onboard aircraft are embedded in systems performing specialized mission-related functions COTS-generic computing devices are increasingly being deployed within the National Airspace System (NAS) and they are occasionally deployed within aircraft as well1 John Knight [7] identifies two primary reasons for the increased use of general-purpose computing devices and hardware (eg microprocessors random access memory (RAM) and memory management unit) 1 For enhanced avionics functionality Specifically entirely new concepts become

possible with the introduction of digital systems These include modern autopilot technology with greater functionality and flexibility than was possible with historic analog systems modern full authority digital engine controls envelope protection systems and flight deck automation (ldquoglass cockpitrdquo)

2 For enhanced safety Examples include aircraft condition analysis and management

systems structural health monitoring and automatic alerts of potential runway incursions

DO-178B and supporting advisory circulars address all phases of the software development process for all software types to ensure that airborne systems are safe This includes electronic flight bag computing devices [8] These cumulative systems processes and guidelines were historically targeted for aircraft environments whose internal networks are specialized to accomplish specific mission functionality Aircraft devices are historically connected via specialized and sometimes proprietary data buses to other devices with which they perform associated functions The nature of these connections is tailored to support their specific communication requirements (eg deterministic real time asynchronous etc) Air-to-ground communication similarly occurs via special-purpose communication systems using special-purpose data communication protocols Visionaries anticipate forces that could motivate future airborne system designs to replace todayrsquos diverse data bus systems within aircraft including many of their current constraints (eg access point limitations proprietary protocols labeling and mitigations such as cyclic redundancy checks) with airplane-appropriate LAN technologies that support standard Internet

1 COTS software components are very rare critical airborne systems and are discouraged from being deployed in

those environments because they cannot comply with DO-178B and other software policy in general

2

protocol (IP)-based communications For example reference 9 concluded that Ethernet-based LANs could be appropriate to serve as aviation data buses if they use

ldquoa switched Ethernet topology along with traffic regulation bandwidth restriction (guarantee and control of bandwidth allocation) and call admission controlrdquo

Coupled with the linkage of aircraft systems via a common network system is a growing perception of the desirability to improve and enhance air-to-ground and air-to-air communication systems and processes as well as to more closely integrate airborne systems with NAS systems For example bull Integrating multiple data bus systems into onboard LAN(s) is expected to reduce aircraft

size weight and power (SWAP) overheads thereby improving aircraft flight performance parameters

bull Next generation aircraft display systems may want to combine map and air traffic data

terrain information weather radar returns information on man-made obstacles and imagery on the airport environment This would require fusing data from sources that are not currently associated together It would also necessitate the support of high-bandwidth data communications internally within the aircraft as well as air-to-ground and within the NAS

bull National Aeronautics and Space Administration Small Aircraft Transportation System

(SATS) is investigating mechanisms that would enable small aircraft to fly to and from the 5400 small airports that are not currently being used for reliable public transportation ldquoA key to implanting SATS is a robust and extremely reliable automated communications system The system must be capable of passing large amounts of data between aircraft and ground systems as well as between neighboring aircraft in a reliable mannerrdquo [10]

bull George Donohue former FAA Associate Administrator of Research and Acquisition has

expressed concerns that the United Statesrsquo

ldquoair transportation network is seriously overloaded in the major cities that support airline hub operations hellip This hellip is leading to a gradual decrease in the US air transportation system safety hellip There is a growing consensus over the last 3 years that the capacity of the US National Airspace System is finite and currently approaching critical saturation limits hellip Without new technology and operational procedures we cannot increase capacity without decreasing the systems safety hellip Without increased capacity the increased cost of air transportation will effectively suppress demand (for new aircraft domestic tourism international travel etc) and have a profound effect on the nationrsquos culture and economy hellip System maximum capacity is very sensitive to aircraft final approach spacing Decreasing aircraft separation in the final approach to a runway from an average of 4 nautical miles between aircraft to 3 nautical miles

3

would increase this capacity in the USA [from the current 30 million operations per year] to over 40 million operations per year hellip [To accomplish this] all commercial aircraft will need to have double to triple redundant collision detection and avoidance systems on the aircraft with professionally trained pilots providing safe aircraft separation The national air traffic control system should be distributed between ground and airborne systems in such a way that it will be almost immune to single point failureshelliprdquo [11]

bull Arguments that the air traffic management system should become network centric to

ultimately achieve the NAS goals Dennis Buede John Farr Robert Powell and Dinesh Verma define a network centric-system as

- ldquoA network of knowledgeable nodes shares a common operating picture

and cooperates in a shared common environment - Functional nodes reside in the cognitive physical and information

domains and communicate with each other and between domains - The heart of the system is the network Knowledgeable nodes may act

autonomously (self-synchronization) with or without a central command and control facility The US Federal Aviation Administration (FAA) refers to the National Airspace System (NAS) which is made up of more than 18300 airports 21 air route traffic control centers (ARTCC) 197 terminal radar approach control (TRACON) facilities over 460 airport traffic control towers (ATCT) 75 flight service stations and approximately 4500 air navigation facilities The airlines and government employ more than 616000 active pilots operating over 280000 commercial regional general aviation and military aircraft hellip

hellip The current improvements to the NAS focus on safety accessibility flexibility predictability capacity efficiency and securityrdquo [12]

bull Evolving airborne software systems to similarly support network centric operations promises enhanced automated aircraft system update procedures and maintenance processes that are not possible with todayrsquos federated systems

The proposed transformation of todayrsquos aircraft and airspace system can be compared to the rapid increase in interoperability seen in commercial and military systems These previous revolutions similarly capitalized on explosive increases in computing power and interconnectivity as well as rapidly evolving protocols and services This rapid rate of change combined with a lack of discipline among commercial vendors who prized functionality over security unfortunately has resulted in a landscape where secure interconnected systems rarely (if ever) exist The anticipated deployment of networked LANs in aircraft is therefore not an isolated event It is a constituent element within the larger network centric evolution of society The implications

4

of linking aircraft-resident systems over a common data bus needs to be considered within the larger context of the network-centric evolution of air-to-air air-to-ground and ground-to-ground communications within the airspace as a whole However with these advantages come risks associated with increased exposure of previously isolated components Aircraft vendors operators and regulators need to understand the impact that interconnected systems may have upon flight safety Design test validation and verification techniques should consider the impact of unanticipated interactions between previously isolated systems In addition the effects of intentional failures caused by malicious software or persons need to be considered Existing evaluation techniques where individual systems have been evaluated in isolation should be updated to address safety concerns introduced by future interconnected systems FAA Order 137082 ldquoInformation Systems Security Programrdquo requires ldquothe FAA must ensure that all information systems are protected from threats to integrity availability and confidentialityrdquo [13] Section 41 of this report explains that networks potentially expose software to larger populations of attack threats As John Knight explains ldquounless a system is entirely self contained any external digital interface represents an opportunity for an adversary to attack the systemrdquo [7] Section 44 explains that COTS computing devices when deployed within networked environments have an indeterminate number of latent security vulnerabilities that can be attacked and potentially exploited COTS systems therefore have very questionable assurance characteristics in networked environments Even though aircraft may not deploy COTS software within their airborne LANs they nevertheless can benefit from the extensive experience gained to date from deploying COTS systems within networks and they may communicate with ground-based networks that widely deploy COTS systems Airborne software and devices unless they have been specifically assured for use in networked environments may or may not manifest similar problems depending on the number and type of bugs present in networked airborne software This is because latent security vulnerabilities when combined with the increased exposure of networked systems can result in security problems that have direct safety implications Vulnerabilities include bull Modification or replacement of authentic aviation software by an alternative variant

introduced by an attacker For example if an attacker could thwart onboard security procedures to download corrupted software of their own choosing then a safety hazard can arise if that corrupted software for example causes the pilotsmdashand the navigation systems they rely uponmdashto believe that their current altitude is 2000 feet higher than it actually is

bull Attacks to network system elements that either hinder correct software operation or else

modify the reported results of correct software operation For example if an attacker takes control of an onboard device and uses it to continuously flood the onboard network with spurious transmissions a safety hazard may arise should that denial of service attack on the network actually succeed in disrupting latency-sensitive real-time transmissions between distributed avionics components and by so doing induce incorrect computation results that affect critical onboard systems

5

Protections against these types of safety threats are primarily accomplished by means of deploying effective information assurance (IA) security controls Safety and security have therefore become intertwined concepts within networked airborne environments Security engineering addresses the potential for failure of security controls caused by malicious actions or other means Safety analysis focuses on the affects of failure modes The two concepts (safety and security) are therefore directly related through failure effects A shortcoming of either a safety process or a security process may cause a failure in a respective safety or security mechanism with possible safety consequences to the aircraft depending on the specific consequence of that failure This study deals with the security and safety issues and acceptance criteria of networked LANs in aircraft In view of the discussion above this study cannot merely evaluate the safety and security implications of introducing LANs to aircraft in an isolated manner Rather the system-wide consequences associated with these changes must be evaluated At a minimum this comprises two distinct but related concepts bull The security and safety issues including acceptance criteria of linking aircraft-resident

systems upon a common network infrastructure This common data bus causes those systems to no longer be physically isolated from each other Rather it links them into a common communications system A direct consequence of this change is that formerly isolated onboard software systems have become theoretically accessible via a common onboard communications system This common onboard communication system is also connected to the aircraftrsquos air-to-ground communication system

bull As described in the bullets shown on pages 3 and 4 anticipated network-centric changes

to the NAS itself results in NAS systems being increasingly redefined into network-centric systems This includes the possibility of aircraft systems being accessible from expanding regions of the NAS Should the NAS itself become connected to public data communications systems such as the Internet then this would result in the theoretical possibility of aircraft being accessible from systems outside of the NAS Specifically should the NAS become connected to the Internet the theoretical possibility exists of accessing aircraft from any location worldwide

By combining these two concepts the net result is the theoretical possibility that specific aircraft-resident systems may become accessible from any location worldwide This possibility has potentially severe safety assurance implications However similar risks result even when no entities using aircraft LANs are involved in communications with entities outside of the aircraft This is because attackers do not need to access aircraft-resident systems to launch electronic attacks upon aircraftmdashsimilar affects can be achieved solely by attacking ground-resident NAS elements For example

ldquoOne of the most frightening images of cyber terrorism is a scenario in which terrorists take over the air traffic control system and cause an aircraft to crash or two planes to collide in flight

6

Industry and governments are extremely sensitive even to the appearance of threats and vulnerabilities A collapse of public confidence in civil aviation safety and a failure to manage public expectation may have serious and widespread economic and social consequencesrdquo [14]

These affects may be similar to the events following the terrorist attacks on September 11 2001 Ken Birman has noted that parallel network-centric evolutions are widespread throughout our society He warns that

ldquoWersquore poised to put air-traffic control banking military command-and-control electronic medical records and other vital systems into the hands of a profoundly insecure untrustworthy platform cobbled together from complex legacy software componentsrdquo [15]

The potential scale of harm from a successful electronic attack against elements within a network-centric NAS system including network-connected aircraft is huge Adversaries may be anonymous and range from individual recreational hackers to well-financed criminal enterprises to well-organized state-led initiatives To the extent that the NAS builds upon COTS technologies the technology employed for electronic attacks will be simple cheap and widely available Reliance upon advances in COTS technology creates an extremely fluid threat environment as historic security vulnerabilities are addressed and new vulnerabilities discovered [16] Fortunately lessons from industry (civilian) and military security processes and experience can be applied to the aviation industry This report therefore examines the safety and security issues introduced by networked LANs on aircraft It seeks to adapt industryrsquos best system security engineering (SSE) practices to identify safety risks caused by aircraft networks It identifies potential security threats and assesses evaluation criteria It leverages best current industry and military practices It proposes specific extensions to ARP 4751 and DO-178B processes to address network security threats and certification issues that arise from networking airborne systems 2 OBJECTIVES AND APPROACH

The purpose of this report is to document evaluation criteria that can be used by certification authorities and industry to ensure that onboard networks will not negatively impact aircraft safety The results will be used by the FAA as input for development of policy guidance and regulations This work is divided into two phases The first phase focused on the potential security risks of onboard networks that affect safety and explored issues and solutions to critical questions raised by the aviation industry as manufacturers consider using LANs in aircraft Initial acceptance criteria for certifying aircraft that use LANs is provided to help evaluators understand the safety and security issues and specific evidence needed to show that proposed designs and countermeasures are sufficient to ensure safety of flight

7

This document also includes the studyrsquos phase 2 effort The phase 2 effort refines the phase 1 results to create specific recommendations to certifiers for the evaluation of the security and safety posture of airplane architectures which include both onboard and offboard networking capabilities Phase 2 also attempts to complete the acceptance criteria started in phase 1 It provides guidelines to help evaluators understand the safety and security issues with networks on airplanes and recommends specific evidence needed to ensure that proposed designs and countermeasures are sufficient to ensure safety of flight This report seeks to answer questions raised by the potential use of LANs on aircraft including bull Are current regulations adequate to address networked airborne security concerns bull How does security assurance fit into the overall certification process including ties to

safety assessment bull What should a network security assurance process contain to enable onboard networks to

meet Title 14 Code of Federal Aviation Part XX1309 [Where XX refers to the particular CFR Part (Parts 23 25 27 29 or 33)]

bull How will continued airworthiness be addressed for onboard networks and how will

regular maintenance be performed in the certification environment bull How can it be ensured that the systems connected to the onboard network cannot

negatively impact safety bull What should the process be for updating security protection software bull How can security breaches be handled Consequently this project bull investigates safety and security issues introduced by using LANs on aircraft bull investigates the potential security risks of an onboard network that could impact safety bull investigates the means for mitigating the security risks in the certification environment bull provides recommendations for assessing safety effects caused by potential security

failures bull provides recommendations for certification of LANs on aircraft

8

21 NOTIONAL NETWORKED AIRCRAFT ARCHITECTURE

Networking aircraft with the NAS is symptomatic of larger societal changes that are arising from the emergence of the worldwide Internet network of networks The Internet has had a profound impact upon many aspects of modern life Many businesses have redefined their relationships with other businesses increasingly basing them upon Internet-oriented electronic commerce technologies The public has also embraced the Internet as witnessed by the growing ubiquity of Internet services such as the worldwide web instant messaging and electronic mail within popular culture Perhaps because of this many aircraft manufacturers are planning to install onboard networks enabling passenger access to the Internet However if an aircraft manufacturer opts to have an onboard network that is available to both passengers and avionics equipment (ie a shared LAN) aircraft safety and security concerns arise As previously mentioned in the introduction parallel evolutionary changes to the NAS increasingly are being proposed that rely upon greater integration between air-based and ground-based airspace systems For example the operational integration of aircraft with the NASrsquo communication and logistics infrastructure promises dramatic improvements in operational efficiency Thus a variety of motivations are increasing the connectivity of aircraft systems to air-based and ground-based network infrastructures Current commercial aircraft systems and networks can be grouped in three major categories closed private and public The closed networks are representative of safety-critical avionics systems private systems represent airline operational systems cabin management systems etc open systems are represented by public Internet services offered to passengers Several changes have been proposed for next generation of aircraft due to the use of local area networking technologies In response to these proposed changes some projects have been initiated in which the common onboard network is designed with partitioning protections The assured robustness of the proposed partitioning is a concern from both a security and safety perspective Previous avionics systems have had their own data bus and have not been accessible by nonavionics systems Security has historically been enforced by a total lack of access (ie an air gap) between systems However as this paradigm changes to support common networked systems the safety and security aspects of the onboard network must be addressed by identifying the resulting risks and establishing appropriate controls to mitigate those risks Several notional views of the current and future aircraft networked systems have been formulated Figure 1 shows one of those views In figure 1 the current (existing) architecture is shown on the left side a logical picture of the proposed target architecture is in the middle and a list of changes to achieve the target (future) architecture is enumerated on the right As previously mentioned a key feature of the existing architecture is its air gap between airborne functions and passenger Internet services Thus there is no way a passenger or entities within

9

the worldwide Internet infrastructure can currently access airborne functions This proposed target architecture alternative by contrast has made three very significant modifications to the current airplane design bull It has created a network within the aircraft itself that supports communications using the

IP protocol family (see section 45) This implies that aircraft control entities logically share a common network infrastructure that is also connected to the nonessential IP network Consequently aircraft control entities are now theoretically connected to nonessential network entities

bull The passenger Internet services have now been connected to the nonessential IP network

This means that all entities within the aircraft will be theoretically connected within the same network system

bull The nonessential worldwide IP network is now connected to NAS and airline ground

systems and the Internet Specifically aircraft control elements are shown to be in the same network system that includes the NAS entities with which they may need to communicate as well as more than one billion people worldwide with Internet connectivity today

Aircraft Control

Airline GroundSystems amp Internet

Non-IP communicationinterface

IP communicationinterface

Existing

PassengerInternetServices

Airborne EquipmentAirborne Equipment

Aircraft Control(containing anIP Network)

Airline GroundSystems amp Internet

Floppy

Non-IP commun-ication interface

IP communicationinterface

Airline GroundSystems amp Internet

Aircraft Control(possibly containing

an IP Network)

Non-essential

IPnetwork

Non-essential

IPnetwork

PassengerInternetServices

Proposed Target

Primary differences in proposed target environment1 Aircraft shares a common

Internet protocol (IP)-based network system

2 Passenger Services AircraftControl and Airline InformationServices share a common network system

3 Specific Aircraft Control andAirline Information Services processes form distributed network relationships with NAS ground computers and potentially other aircraft

Difference1

Difference2

Difference3

Figure 1 Notional Networked Aircraft Architecture

The FAA (ACB-250) community has provided a generic future communication system physical architecture proposal taken directly from reference 17 and is shown in figure 2 which provides greater detail about the network links of the figure 1 target alternative

10

Controller

Aircraftoperator

ATC Voice

ATC Data

AOCAAC Data

Public Internet

Control Site

ControlSite

Equipment

MMC

Technicians

MMC

Technicians

Remote Site

RemoteSite

Equipment

Avionics

Aircraft Pilots

Crew

Passengers

AvionicsAvionics

Aircraft Pilots

Crew

Passengers

Avionics

Aircraft Pilots

Crew

Passengers

AvionicsAvionics

Aircraft Pilots

Crew

Passengers

H

G

G

F

E

Other Control Sites

A

B

C

D

AAC = Airline Administration Communication ATC = Air Traffic Control

AOC = Airline Operational Communication MMC = Maintenance monitor and control

Figure 2 Generic Future Communication System Physical Architecture [17]

Advocates have identified undesirable security implications with the approach shown in figure 1 related to potentially exposing avionics systems to passenger devices and systems These advocates argue that the advantages achieved by removing the historic security air gap between avionics and passenger systems cannot justify the increased risk to avionic systems posed by that connectivity Consequently they have identified an alternative target architecture which is shown in figure 3

Primary differences in proposed target environment1 Aircraft Control and

Airline InformationServices share a common network system

2 Specific Aircraft Control andAirline Information Services processes form distributed network relationships with NAS ground computers byusing an IP-based air-to-groundlink

However the air gap between the Aircraft passengers and the avionics systems remains in tact

Aircraft Control

Airline GroundSystems amp Internet

Non-IP communicationinterface

IP communicationinterface

Existing

PassengerInternetServices

Airborne EquipmentAirborne Equipment

Aircraft Control(containing anIP Network)

Airline GroundSystems amp Internet

Floppy

Non-IP commun-ication interface

IP communicationinterface

Airline GroundSystems

Aircraft Control(possibly containing

an IP Network)

Non-essential

IPnetwork

Non-essential

IPnetwork

PassengerInternetServices

Proposed Target

Internet

Difference1

Difference2

Figure 3 Alternative Notional Aircraft Architecture

11

While there are strong motivations (see section 1) arguing for the migration indicated in either figure 1 or figure 3 to take place there are security and safety reasons for why the current airborne architecture should not change Specifically the existing system is safer and more secure than either of the target systems Section 4 explains some of the reasons why the proposed changes that form the target designs result in significantly more risk to aircraft A summary of these reasons include the following bull The larger the networked community of devices the larger the potential number of

threats to the entities within those networks due to (1) direct or indirect relationships between the networked entities themselves and (2) the increased possibility of hostile attackers being present within the system

bull Due to the emergence of client-side attacks and other threats the (human) end users of

networked resources are now an important part of that networkrsquos total security defense posture Aircraft have limited control over the computer and network behavior of their Internet-connected passengers NAS employees as well as aircraft crew members must be trained to ensure that their own computer behavior does not inadvertently enable attacks against the aircraft This has direct security implications to both the airborne systems themselves as well as to those networks with which the aircraft connects

bull Entities within networks that are directly or indirectly connected to the Internet may

possibly be accessible by attackers located elsewhere in the Internet despite the presence of intervening security firewalls This implies that more than one billion people may (theoretically) potentially have access to aircraft

bull The Internet has experienced many well-documented instances of hostile attacks

affecting the integrity of computers networked systems and the data and services they support

bull COTS computer systems have an indeterminate number of latent bugs that can be

attacked bull COTS computer systems cannot be adequately secured within large network

environments in general because their security controls cannot be trusted to perform as intended when attacked They represent possible footholds that attackers can compromise and use as a base from which to attack other networked entities

bull Security vulnerabilities including those stemming from deploying COTS devices or

systems can theoretically be mitigated However the viability of those mitigation approaches are themselves suspect to the extent that they rely upon COTS systems for their implementation This is because COTS software and systemsmdashand the functionality they supportmdashare not trustworthy when attacked

12

bull The security viability of current networked systems is partially a direct function of the network and system management (including configuration management) expertise of its administrative personnel

bull The protocols of the IP family can be secured but their cumulative underlying key management system is ad hoc and complexmdashwith direct configuration and management implications

bull The IP familyrsquos network management system including its underlying simple network

management protocol version 3 (SNMPv3) protocol has questionable security viability when used in network environments that have large numbers of devices built by many different vendors

bull Whenever different security administrations or technologies are joined together in a

cooperative manner (eg aircraft and ground systems) it is important and challenging to define the interfaces between the systems in such a way that a diminished security posture for the combined system as a whole does not result

This report describes assurance mechanisms to mitigate these threats However the mitigation system has one key missing element (see section 72) Until that element has been successfully addressed no networked system can currently be guaranteed to be as safe or as secure as the currently deployed non-networked airborne systems 22 WHY BOTH TARGET ALTERNATIVES HAVE SIMILAR SECURITY POSTURES

It was mentioned that the architecture in figure 3 is more secure than the architecture in figure 1 However both alternatives have similar security postures such that the same network solution which is described in section 83 addresses the security and safety requirements for both target alternatives Figure 4 shows that both target alternatives similarly expose onboard aircraft systems to possible attacks from the worldwide Internet infrastructure for the reasons explained in section 41 While the air gap between passenger and avionics equipment of figure 3 (see bottom of figure 4) protects avionics systems from being directly attacked intra-aircraft from the passenger network they are still theoretically exposed to remote passenger or Internet attack via the NAS

13

Aircraft

World wide Internet Infrastructure

Air Gap in Aircraft Alternative No Air Gap in Aircraft Alternative

ControSit

NAS Both target approaches are - based threatsexposed to Internet

Second approach is somewhatmore secure than the first buthas greater size weight andpower (SWAP) requirements

Risk mitigation controls are very similar for both targets

Both targets use the same proposed target network architecture design Aircraft

Worldwide Internet InfrastructureAir Gap physically separates passenger communications from avionicscrew communications

avionic

passengers

NAS

Figure 4 Both Target Architectures Have Similar Security Profiles

Consequently the primary advantage of the target approach shown in figure 3 versus the target approach shown in figure 1 is that the figure 3 approach enables the port 80 (ie hypertext transfer protocol (HTTP)) overt channel to be closed within the aircraftrsquos perimeter defense firewall (see section 835) thereby eliminating a vulnerability by which firewall protections can be circumvented There are also two helpful secondary affects of the figure 3 approach bull The packet filter design (see section 834) is simplified Passenger communications of

the figure 3 approach do not traverse avionics networks Consequently the avionics network of that approach does not require that the packet filter system protect it by enforcing quality of service (QoS) provisions upon passenger communications to ensure that those communications do not consume too much avionics LAN capacity Similarly the packet filter would no longer need to ensure that passengers cannot address the encapsulation gateways (see section 833) or the cockpit (pilot) network since there would be no connectivity to those systems However the figure 3 approach still requires that the packet filter be retained to ensure that the noncockpit crew network cannot send packets to the encapsulating gateways unless those crew systems could be provided with physical security guarantees that they are never accessible to passengers

bull The high-assurance LAN (see section 837) is similarly simplified because it no longer

must be deployed in a manner to ensure that the passenger network can only access other avionics systems by means of the packet filter Rather different physical LAN systems must be used by the passenger system and the rest of the aircraft

Consequently the figure 3 approach does not eliminate the need to deploy a packet filter within the aircraft but it does simplify what that packet filter system does However the figure 3

14

alternative requires that parallel (ie distinct) sets of onboard networks and wireless external communications systems be created one for passengers and one for the other aircraft systems The figure 3 approach therefore has a higher SWAP overhead than the figure 1 approach by requiring parallel internal (onboard LAN) and external network (radio satellite etc) connectivity without significantly improving the security profile for the aircraft itself 3 EXTENDING THE CURRENT FAA CERTIFICATION ENVIRONMENT

The purpose of this section is to provide an orientation for how this study recommends that the certification environment be extended to handle networked airborne LANs The specific theory rationale and process underlying this studyrsquos recommendations are explained in subsequent sections (ie sections 6 7 and 8) It was previously mentioned that current FAA and civil aviation safety assurance processes for airborne systems are based on ARP 4754 ARP 4761 and the ACs FAA software assurance is based on compliance with DO-178B and complex electronic hardware design assurance is based on DO-254 The primary FAA certification standards are the respective regulations FAA policy and the ACs This study addresses how to extend these processes and certification environment to include networked airborne LANs in a mathematically viable manner Because of the large scope of the current FAA policies and processes this report addresses this larger task by explaining how to specifically extend its airborne software assurance subset Figure 5 shows a simplified and abstracted view of the current FAA software assurance approval process It shows that airborne software is currently developed and approved primarily according to the guidance and processes described within DO-178B2 When individual software items are combined into integrated or complex systems then additional safety considerations apply which are documented in ARP 4754 These considerations address integration issues and system vulnerabilities that may arise from system dependencies ARP 4754 refers to each element within that system as being an item This same terminology is adopted by this study DO-178B builds upon system design concepts such as the AC 251309-1A fail safe design concepts one of which is integrity Both DO-178B and ARP 4754 (ie section 222 of DO-178B where it is called the ldquosoftware level definitionsrdquo and Table 3 of ARP 4754) rely upon the same five failure condition categories Indeed the same failure condition categories are consistently used within other civil aviation documents as well (eg Table 2-1 of DO-254 and Table 1 of ARP 4761) Different development processes are applied to items classified in different failure condition categories so that items classified in the more severe safety failure conditions are developed by more extensive processes that produce higher assurance results For software items this is reflected in the DO-178B software level definitions For this reason this report refers to DO-178B software levels as reflecting safety assurance levels

2 There are other applicable policies and guidance in addition to DO-178B that can also be applied Please recall

that this figure is a simplified abstraction

15

Stand-alone Software System

ComplexSoftware

ComplexSoftware

ComplexSoftware

1) Stand alone software systemFocuses on that software entity (DO-178B)

2) Integrated or Complex SystemsAddresses each software Item (DO-178B) as well as the potentially complex affects resulting from their integration together (ARP 4754)

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

3) Networked Airborne LANsA complex system in which every entity in the same network (ie the LAN and whatever the LAN directly or indirectly connects to) is inadvertently integrated togetherregardless of the functional intent of the system design

Processes must now also address possible networkinteractions during (and resulting from) network attacks

Fate sharing any compromised network entity can theoretically be used to attack other networked entities or their shared network environment

Other connectedLANs andNetworks

Finite Number of Entities Concerned with effective integration techniques

Concerned with fate sharing in a hostile environmentArbitrarily Huge Number of Entities

Figure 5 Three Different Software Certification Environments

ARP 4754 is directly concerned with architectural considerations that pertain to highly integrated or complex airborne systems

ldquoSystem architectural features such as redundancy monitoring or partitioning may be used to eliminate or contain the degree to which an item contributes to a specific failure condition System architecture may reduce the complexity of the various items and their interfaces and thereby allow simplification or reduction of the necessary assurance activity If architectural means are employed in a manner that permits a lower assurance level for an item within the architecture substantiation of that architecture design should be carried out at the assurance level appropriate to the top-level hazard hellip It should be noted that architectural dissimilarity impacts both integrity and availability Since an increase in integrity may be associated with a reduction in availability and vice-versa the specific application should be analyzed from both perspectives to ensure its suitabilityrdquo (Quoted from Section 541 pages 25 and 26 of reference 1)

Because ARP 4754 addresses possible system vulnerabilities that derived from creating functional system relationships between items to a certain degree it can be characterized as being directly concerned with effective integration techniques between those system items It therefore presumes that the regulator can correctly identify the items that comprise a system as well as their mutual relationships together

16

Aircraft network security is a systems issue System development (ARP 4754) in conjunction with the system safety assessment process (ARP 4761) is responsible for defining network accesses vulnerabilities detection and protection requirements Some of the vulnerabilities will be mitigated by limiting and controlling access by using hardware and software capabilities Some identified vulnerabilities will be mitigated by monitoring and detection capabilities The security protection should be defined by the system and then by appropriate system requirements allocated to hardware software and hybrids This study assumes that best current IA practice will be followed including deployment of traditional IA security controls when appropriate After implementation these protections mitigations and monitoring will also likely be verified and validated at the system level as well Consequently aircraft network security is an ARP 4754 issue However approving networked systems in some ways should be recognized as being a significant extension to ARP 4754 Networked systems differ from the current ARP 4754 environment in several significant ways Networked elements are systems that include all of the networks and their constituent elements and users to which the network is directly or indirectly attached Networks are therefore arbitrarily huge and the many interrelationships of the system items are often too subtle to discern Networks are inherently complex systems in which every item in the network is inadvertently integrated regardless of whether those items share any common functional goal Approval of networked entities must now also address possible network interactions that occur during and result from network attacks The various networked elements potentially have a fate sharing relationship with each other because any compromised network entity theoretically can be used to attack other networked items or their shared network environment Therefore networked airborne LAN environments are inherently ldquohighly integrated or complex aircraft systemsrdquo with attributes that extend the complex relationships for which ARP 4754 was created Section 4 and appendix A will introduce some of the risks that characterize networked systems and underlie the following observations bull In networked environments ARP 4754 needs to be extended to consider each item within

the LAN to be integrated even if that item has no functional relationship with anything else For example

- If the LAN experiences a successful denial of service (DoS) attack then each

networked item in that LAN may potentially be unable to fulfill its function Therefore ARP 4754 must be extended in networked environments to ensure availability

- If an item in the LAN becomes hostilely compromised by an attacker then it

potentially can be used by that attacker to attack the network itself or other items on the LAN Therefore ARP 4754 must be extended in networked environments to address LAN and item integrity To ensure LAN and item integrity ARP 4754 needs to be extended to require verifiably secure software installation procedures as well as mechanisms to ensure the continued integrity of deployed items and systems

17

bull If airborne LANs are connected into networks then the cumulative network system has

similarly become integrated and existing safety processes need to become extended to each system and item within that larger networked system if they are to remain viable even if any component element within the larger system never itself becomes airborne

bull If the network has both device and human users then ARP 4754 must also become

extended to also pertain to humans Every human or device with access to that network is a potential threat to that network and may potentially initiate attacks against the network itself the LANs or subnetworks that comprise that network of the items located within that network If the network is directly or indirectly connected to the Internet then there are theoretically more than one billion humans with potential access to that airborne LANmdashdespite the presence of intermediate firewalls This means that mechanisms are needed within networked systems so that human behavior cannot deprecate historic DO-178B and ARP 4754 safety assurances

This study identifies mechanisms by which ARP 4754 can be extended to address networking requirements by strategically introducing integrity and availability security controls It does this by building upon a mathematically based security model that can extend ARP 4754 concepts into arbitrarily vast and complex network systems This study uses proven SSE processes to combine these concepts and controls into the exemplar network architecture (see section 8) This study is also similarly concerned with extending DO-178B so that highly assured software items within networked environments can be developed and assured to mitigate known network risks The concept of highly assured software in networked environments explicitly means that the software can be trusted to behave in the same fashion before during and after attacksmdashsomething that current DO-178B processes cannot ensure because they do not explicitly address network attack threats Consequently current DO-178B software in networked environments may behave in an indeterminate manner during or after attacks if latent bugs within the software itself are successfully attacked by exploits that violate its integrity Such software is a potential threat to its deployment environment It is potentially subject to misbehavior corruption or compromise potentially including becoming used as a launching pad to attack other systems and items This issue is addressed in section 72 This study does not provide suggestions for the process by which the FAA or the worldwide civil aviation community may choose to respond to these recommendations It may be that the relevant experts may conclude that the revision of ARP 4754 and DO-178B that this study presumes is an unacceptably long term or unreliable approach for ensuring that network security concerns are adequately addressed in a timely manner If so then it is conceivable that the FAA may decide to produce an airborne network system security assurance policy in the near term If this is done then if SAE and RTCAEUROCAE subsequently decide to address this issue in the future then that initial policy could be revised to reflect their proposal

18

4 NETWORK RISKS

This section specifically discusses network security issues that are directly relevant to airborne safety and security within networked environments Two papers authored by Daniel Mehan [18 and 19] the former FAA Chief Information Officer (CIO) provide an important context for the material discussed in this section These papers describe the cumulative processes needed to create a secure and safe NAS environment These processes are partially summarized in figure 6 The majority of the topics covered in this section directly focus on network system aspects of ldquoCyber Hardening of System and Network Elementsrdquo shown in figure 6 of a total protection system Many other aspects of NAS safety and security are not addressed within this section and are only briefly addressed by this study

PersonnelSecurity

PhysicalSecurity

Cyber Hardening ofSystem and Network Elements

Compartmentalization

RedundancyArch

itectu

re a

nd E

ngine

ering

Awareness and Execution

Figure 6 The FAA Five Layers of System Protection [18]

Reference 20 also provides very helpful concepts and background information for the aircraft network safety and security topics presented in this section and appendix A It is important to recognize that network threats are always evolving An indeterminate number of network threats exist These network threats can mutate quite rapidly For example the following is an example of a current network threat that did not exist the year before this study was written

ldquoFile encrypting Trojans are becoming so complex that security companies could soon be powerless to reverse their effects a new report from Kaspersky Lab said

19

The report notes the rapid evolution of the public key encryption used by one family of crypto malware Gpcode which went from using 56-bit to 660-bit RSA [encryption key] in a matter of weeks Commonly termed lsquoransomwarersquo Trojans that encrypt data files on a userrsquos [personal computer] PC before demanding a payment in return for supplying the key to unlock the files have come from nowhere in recent months to become a measurable problem At the time of its discovery in June [2006] Gpcodeag ndash which used a formidable 660-bit key ndash Kaspersky described the process required to decrypt such a key as equivalent to setting a 22 GHz PC to work for thirty yearsrdquo (Quoted from reference 21)

Defenses that require a response to each new threat instance as it appears are both expensive and of questionable efficacy The best mechanism to effectively constrain the impact of these threats over time is to create a very solid safety and security foundation for both the NAS and aircraft Figures 7 and 8 were created by David Robinson [22] to indicate the possible threat affects that can occur when networked aircraft becomes successfully attacked These types of threats cannot occur for aircraft whose aviation systems are not attached to network systems

ldquoThese new generation aircraft [eg B787 A370 A350 BY-1] will include a new aircraft data network design which will introduce new cyber security vulnerabilities to the aircraftrdquo [22]

Unless properly mitigated any networked aviation system is potentially subject to the following range of impacts should they be successfully attacked

20

General Threat

Identifiers Aircraft Data Network Threats

Aviation Infrastructure Mission and Operational

Impact FAILURE Safe state of the aircraft system could

be compromised in the event of a security penetration

Access to the flight controls by unauthorized individuals affecting safety

DENIAL Aircraft system resources exhausted due to denial of service attack system error malicious actions

Critical services disrupted by system overload or traffic jamming

Access Control

Individual other than an authorized user may gain access to the aircraft system via phantom controller masquerade or spoofing system error or an attack for malicious purposes

Unauthorized Access

Passive Attack

Snooping or eavesdropping compromising security (misdirection) Design Flaws may lead to back door access

Unauthorized corruption or destruction of data causing unsafe flight conditions

Figure 7 Network Threat Mission and Operational Impact [22]

Threat Targets Threat Effects

Aircraft Operation Serious degradation or loss of mission capability airline is not able to perform its primary function

Assets Major damage to airline assets Financial Major financial loss Human Serious or catastrophic physical harm to individuals Public Perception Total loss of confidence in air traffic by passengers

disclosure of security information

Figure 8 Airborne Network Threat Targets [22]

The subsequent sections describe technical mechanisms to mitigate these risks 41 DIFFERENT UNIVERSES STAND-ALONE VERSUS NETWORKED

It is commonly recognized that the safety and security assurance properties of stand-alone systems are much more easily ascertained than the assurance of systems within networked environments This difference is primarily due to the fact that the assurance of stand-alone entities is a function of the inherent design of that system itself These include the repertoire of issues currently considered by DO-178B such as hardware and software design input-output direct memory access interrupt and interrupt processing design and development process controls operating system (OS) issues and security modes The assurance of networked systems by contrast is a function of not only that systemrsquos own internal design and processes

21

but also the implications of the effects to its design and operation caused by the other elements within the total system as a whole As Joel Knight has observed

ldquoUnless a system is entirely self contained any external digital interface represents an opportunity for an adversary to attack the system It is not necessary for an adversary to have physical access Of necessity many systems will communicate by radio and digital radio links present significant opportunities for unauthorized accessrdquo [7]

A great many issues partially determine the susceptibility of any networked item to possible attacks bull To what extent is an entity manageable If it is manageable how secure is the identity

authentication authorization and access control processes imposed upon administrative personnel and processes (eg separation of duties with least privilege)

bull To what extent is the entity configurable If it is configurable what controls ensure that

it is configured correctly bull How confident (eg assurance level) is the designer certifier and designated approving

authority (DAA) that there is a total absence of latent software bugs that can be attacked by hostile attackers to create safety threatening affects

bull How impervious is the implementation to attacks originating from other devices

including how dependent is the implementation upon inherent network availability or security attributes

bull How dependent is the entity upon other distributed components Can their misbehavior

result in safety threatening scenarios bull What is the relative security and integrity assurance of the data communications

protocols and underlying network media (including networking devices) used within that network infrastructure

The potential interaction of these networked elements is complex The possible complexity of these interactions is a partial function of the number of elements within the total system and the number of possible interaction mechanisms Some possible interactions can be unintended and subtle For example a system can be assured as being safe in a controlled environment using DO-178B processes However is this assurance still viable if that system is transplanted into a highly networked environment where unforeseen processes may try to influence it in unanticipated ways Will a real-time system perform adequately in environments where it is continually being accessed by a rogue process Even if the rogue process fails all authentication and authorization attempts can it still consume enough central processing unit (CPU) or network capacity

22

resources so that the required real-time interactions of that system with its legitimate peers are detrimentally impacted A basic attribute of network environments is that risks to elements within that system increase in direct relationship to the networkrsquos population size The larger the community of networked devices the greater the possibility that at least one of those devices has been constructed with latent bugs that can be leveraged to compromise that device to directly or indirectly attack other parts of the system Also the larger the community of humans that can access elements within the total network system the greater the possibility that at least one of those humans will exploit bugs either intentionally (maliciously) or accidentally Hostile electronic attacks may be conducted by both the corrupted insider (eg insider threat) as well as by unauthorized personnel who have leveraged system or process blemishes to gain unauthorized (remote) entry into the system It can also occur by means of accidental mistakes made by authorized personnel Widely used COTS network equipment such as Internet technologies is more easily assembled into large network systems than less popular communications technologies For example the Aeronautical Telecommunications Network (ATN) which is used for air traffic management systems today is built using open system interconnect (OSI) protocols OSI protocols are rarely deployed today except within specialized niche environments Because of this it is comparatively difficult to link ATN systems with other networks to create large network communities IP systems by contrast are ubiquitously deployed today Because of this it is comparatively easy to link together IP-based systems with other networks to create large network environments A key point to recognize is that just because an IP-based system is not connected to a large network environment today does not mean that it cannot easily be connected into a large networked environment tomorrow perhaps inadvertently For example inadvertent exposure of allegedly stand-alone (ie physically isolated via an air gap) IP networks to remote Internet-based attacks have occurred many times in real life by means of inadequately secured modems located within those allegedly isolated networks Widely deployed public networks have larger populations of users than small private networks The more people within the networking community the greater the probability that one or more of them may pose an attack risk to the elements within the system The larger the cumulative number of users within any aspect of the network the greater the possibility is that a user may purposefully or accidentally exploit those weaknesses in a detrimental manner The inclusion of the words ldquoaspect of the networkrdquo in the previous sentence is a reference to a technical point that is partially explained within appendix A That point is that in large network-of-network systems such as the worldwide Internet network access control defenses are established between discrete network administrative entities by means of security firewalls [23] Firewall technologies have significantly improved over time Unfortunately so has the sophistication of attacks against them A class of exploits3 exist that may possibly circumvent the access control protections of firewall systems Should these attacks succeed then those attackers could access network systems where they are not authorized

3 eg fragmentation attacks time-based attacks HTTP-based (Port 80) attacks and other emerging exploits

23

Specifically most networks implement firewall policies that permit remote access into the autonomous systems (AS) they protect through a port 80 (ie HTTP) overt channel Consequently many sophisticated attacks explicitly leverage the policy weakness that enables this overt channel to penetrate firewall systems Only a small percentage of currently deployed networks today have closed port 80 Even when administrative policy permits this vulnerability to be closed the efficacy of correctly configured firewalls using the very best technology can be circumvented by client-side attacks (see section 42) or improper configuration of other system elements (eg modems) Also firewalls that are deployed in SWAP-constrained environments (eg aircraft) are often susceptible to a range of modern attacks (eg fragmentation attacks time-based attacks) because they may not contain the necessary resources (eg CPU or RAM) to handle those attack vectors Consequently firewall protections can potentially be circumvented Firewalls therefore need to be part of a larger defense-in-depth system (see section 51) which needs to provide redundant protections (eg virtual private networks (VPN) see section 56)) to supplement the firewall in case its protections are circumvented In view of this potential danger the number of people that can access a network should not be equated to the number of people that are authorized to access that network Rather it should be considered to be the total number of people that can access any part of the larger network system in which that network is a part This explicitly includes users that are solely authorized to access another network to which onersquos own network is only indirectly connected Consequently if airplanes are even indirectly connected to the Internet then theoretically there are over one billion people that can potentially access entities within that airplane 42 INTERNAL EXTERNAL AND CLIENT-SIDE ATTACKS

Because networked systems traditionally use perimeter defense mechanisms (security firewalls) to limit access to internal network resources a distinction has been created between insiders and outsiders An insider is an individual who is authenticated and authorized to use internal network resources regardless of whether or not they are physically located geographically in the same location as the networked resource Outsiders are not authorized to have such access A large percentage of security controls have historically been centered on repelling security attacks from outsiders This reflects the fact that insiders usually undergo scrutiny to obtain their authorizations However higher assurance environments need to consider the possible threats stemming from corrupted insiders (ie the insider threat) These environments need to deploy controls so that the activities of all authorized users inside the network are restricted in terms of separation of duties with least privilege Unfortunately an entirely new class of attack the client-side attack has become increasingly popular and dangerous Client-side attacks include inadvertent exposure to hostile e-mail attachments or accesses to malicious web pages containing executables or scripts that allow arbitrary code to run In both cases the attacker leverages latent security vulnerabilities within the userrsquos web browser or e-mail client

24

ldquoWith the rise of client-side attacks a flaw emerges in the old [security] model despite avoiding a direct connection to the outside users might still be attacked by the very services that theyrsquove requestedrdquo [24] ldquoA new attack vector has been created in which users are transformed into a platform to attack internal resources without their consent or even their awareness Users are no longer passive participants in the security model theyrsquove become the very service by which entrance is gained into the protected interior of the networkrdquo [16]

There are many published examples of successful client-side attacks including the following

ldquoThe Oregon Department of Revenue has been contacting some 2300 taxpayers this week to notify them that their names addresses or Social Security numbers may have been stolen by a Trojan horse program downloaded accidentally by a former worker who was surfing pornographic sites while at work in January [2006] An investigation by agency security personnel and the Oregon State Police found that the malicious program was designed to capture keystrokes on the former employeersquos computer hellip The employee was an entry-level worker who was assigned to enter taxpayer name and address changes as well as some social security numbers lsquoWe know that the information that the Trojan gathered up was transmitted outside of the agencyrsquo to an unrelated Web site The incident is still under investigationrdquo [25]

Therefore attacks against networked entities may occur from outsiders from corrupted insiders as well as from client-side attacks (see figure 9) The effect of outsider attacks is to emphasize perimeter defense protections (eg firewalls VPNs) The effect of corrupted insiders is that network security is no longer primarily a function of establishing adequate perimeter defense controls it now must also include viable access control within the network itself The effect of client-side attacks is that network security is no longer solely a function of the total control protections established on devices within the network It is now also reliant upon the appropriate activities of every human using those network resources While filtering services located at the perimeter defense firewalls can and do combat client-side attacks however new attacks are continually being devised that perimeter defense filtering systems must be updated to identify and eliminate Consequently there is often a vulnerability window between when a new attack type has been devised and when the protections against that new attack have been deployed For this reason defense against client-side attacks heavily relies upon end-user educationmdashand can be circumvented by end-user mistakes

25

bull Corrupted or Careless Insiderbull Are authorized to access the networkbull Eg NAS personnel aircraft personnel or passengers local systems

bull Hostile Outsiderbull Are not authorized to access the networkbull May be located on ldquothe Internetrdquo

bull Client-side Attacksbull Malicious software lurking in ldquoneutralrdquo environments (eg email web

sites other) bull The historic distinction between ldquodatardquo and ldquocoderdquo is vanishingbull NAS personnel aircraft personnel and aircraft passengers may be duped

into inadvertently executing and thereby introducing malicious software into the network

bull Network users therefore have become an integral element of a networkrsquos security defenses

Figure 9 Threat Agents in a Networked Environment

This topic will resume in section 44 when the implications of mixing embedded systems and generic OSs within the same network will be discussed Before that discussion can occur however it is first necessary to discuss the vulnerabilities that exist within a networked environment 43 COMMERICIAL OFF-THE-SHELF VULNERABILITIES IN A NETWORKED ENVIRONMENT

While this section specifically addresses well-known COTS vulnerabilities in networked environments similar problems may or may not exist within embedded avionics systems depending upon whether latent bugs exist within those systems that can be exploited by network attacks Lance Spitzner has gathered together the following statistics which provide partial evidence that the worldwide Internet infrastructure is a very dangerous place bull ldquoAt the end of the year 2000 the life expectancy of a default installation of Red

Hat 6 a commonly used version of Linux [a computer OS] was less than 72 hours

bull One of the fastest recorded times a honeypot [ie a device deployed in order to

study the behavior of electronic attackers] was compromised was 15 minutes This means that within 15 minutes of being connected to the Internet the system was found probed attacked and successfully exploited by an attacker The record for capturing a worm was under 90 seconds

26

bull During an 11-month period (April 2000-March 2001) there was a 100 percent increase in unique scans and an almost 900 percent increase in Intrusion Detection Alerts based on Snort [an Intrusion Detection utility]

bull In the beginning of 2002 a home network was scanned on average by 31 different

systems a dayrdquo [26] This list can be supplemented by many other data points including bull ldquoThe most virulent [computer] virus to date infected several million machines in

about 20 minuteshelliprdquo [15] bull ldquoWhen we put this [honeypot] machine online it was on average hit by a

potential security assault every 15 minutes None of these attacks were solicited merely putting the machine online was enough to attract them The fastest an attack struck was mere seconds and it was never longer than 15 minutes before the honeypot logged an attempt to subvert it hellip

bull At least once an hour on average the BBC honeypot was hit by an attack that

could leave an unprotected machine unusable or turn it into a platform for attacking other PCs hellip

bull By using carefully crafted packets of data attackers hope to make the PC run

commands that hand control of it to someone else Via this route many malicious hackers recruit machines for use in what is known as a botnet This is simply a large number of hijacked machines under the remote control of a malicious hackerrdquo [27]

bull ldquoIronPort recently published a report showing that Trojan horses and system

monitors ndash two of the most serious types of malware ndash infect one out of every 14 corporate PCs That means that in an organization of 1000 desktop PCs there is an average of 70 computers that represent a major security risk hellip Dwarfing Trojans and system monitors are less serious types of malware such as adware and tracking cookies which infect 48 and 77 of PCs respectivelyrdquo [28]

bull ldquoThe number of new [COTS] software security vulnerabilities identified by

security experts hackers and others during the first eight months of this year [2006] has already exceeded the total recorded for all of 2005 according to Internet Security Systems Vulnerabilities through September have reached 5300 leaping past the 5195 discovered for all of 2005 says Gunter Ollmann director of the X-Force research group at ISS lsquoEight hundred seventy-one were found to affect Microsoft operating systems while 701 vulnerabilities were only found to affect Unix operating systemrsquo Ollmann says But many vulnerabilities cross platform

27

boundaries to affect them all including Linux About 3219 vulnerabilities fall into that realm Ollmann notes ISS ranks vulnerabilities as critical high medium and low Of the 5300 vulnerabilities recorded for 2006 so far 04 percent were deemed critical (could be used to form a prolific automated worm) 166 percent were deemed high (could be exploited to gain control of the host running the software) 63 percent were medium (could be used to access files or escalate privileges) and 20 percent were low (vulnerabilities that leak information or would allow a denial-of-service attack) hellip lsquoOf the 5300 vulnerabilities hellip 876 percent could be exploited remotely 108 percent could be exploited from the local host only and 16 percent could be exploited remotely and localrsquordquo [29]

The Computer Emergency Response Team4 (CERT) coordination center keeps a monotonically increasing list of reported Internet-related security incidents dating from 1988 to 2003 inclusive5 These statistics show that there was more than a 100 percent increase in reported security incidents in 2001 increasing from 21756 in 2000 to 52658 in 2001 The most recent incidents were publicly disclosed in 2003 which had 137529 different reported security incidents As the CERT notes ldquoan incident may involve one site or hundreds (or even thousands) of sites Also some incidents may involve ongoing activity for long periods of timerdquo [30] The CERT ceased reporting the number of security incidents after 2003 because ldquoGiven the widespread use of automated attack tools attacks against Internet-connected systems have become so commonplace that counts of the numbers of incidents reported provide little information with regard to assessing the scope and impact of attacks Therefore as of 2004 we will no longer publish the number of incidents reportedrdquo [30] An example of an undisclosed incident occurring since 2003 is the following

ldquoChinese hackers launched a major attack on the UK Parliament earlier this month the governmentrsquos e-mail filtering company MessageLabs Ltd has confirmed The attack which occurred on Jan 2 [2006] attempted to exploit the Windows Metafile (WMF) vulnerability to hijack the PCs of more than 70 named individuals including researchers secretaries and members of Parliament (MP) themselves E-mails with an attachment that contained the WMF-exploiting Setabortproc Trojan horse were sent to staffers Anyone opening this attachment would have enabled attackers to browse files and possibly install a key logging program to

4 CERT see httpwwwcertorg 5 See httpwwwcertorgstatscert_statshtml

28

TABLE OF CONTENTS Page EXECUTIVE SUMMARY xiii 1 INTRODUCTION 1

2 OBJECTIVES AND APPROACH 7

21 Notional Networked Aircraft Architecture 9 22 Why Both Target Alternatives Have Similar Security Postures 13

3 EXTENDING THE CURRENT FAA CERTIFICATION ENVIRONMENT 15

4 NETWORK RISKS 19

41 Different Universes Stand-Alone Versus Networked 21 42 Internal External and Client-Side Attacks 24 43 Commerical Off-the-Shelf Vulnerabilities in a Networked Environment 26 44 Mixing Embedded Systems and Generic Operating Systems 31 45 Internet Protocol Family Security 35 46 Network ManagementmdashNetwork Security Concern 43

461 The SNMP has no Provisions for Two-Factored Authentication 44 462 The SNMP Symmetric Keys may be Assembled From Passwords 44 463 The SNMP Key Updates do not Provide for Perfect Forward Secrecy 45 464 The SNMP Symmetric Key Distribution Problems 45 465 The SNMP Currently Lacks Demonstrably Viable Session Keys 46

47 Mixing Different Communication Protocol Systems 46

471 Significant Semantic Differences to Allegedly Similar Concepts 48 472 Integrating Dissimilar Protocol Families 48

48 Identity Problem 50 49 Integrated or Cooperating System of Systems 51

5 NETWORK SECURITY DEFENSES 52

51 Defense-in-Depth 52 52 Department of Defense Networking 55 53 Internet Protocol Topology Hierarchy and Policy Systems 58 54 Mechanisms to Connect Aircraft to Networks 59

541 Aircraft and Network Mobility 60

iii

542 Aircraft as a Node (MIP and MANET) 60 543 Multilevel Network Systems (RED-BLACK VPN) 61

55 Airplane Routing and Autonomous Systems 62 56 Virtual Private Networks Enable Network Partitioning 66 57 Security Zones and Policy-Based Networking 69

6 RELATING SAFETY AND SECURITY FOR CERTIFICATION 73

61 Security Requirements of Airborne Networked Environments 74

611 Integrity 75 612 Availability 77 613 Authentication 78 614 Confidentiality 79 615 Nonrepudiation 79

62 Extending FAA Orders Guidance and Processes Into Vast Network Systems 79 63 Comparing Civilian Aircraft Safety and Federal Government Security Levels 83

631 Civil Aircraft Software Levels 83 632 Federal Government Security Classifications 85 633 Comparison of the Two Policy Systems 86

64 Biba Integrity Model and Bell-LaPadula Confidentiality Model

are Direct Analogs 87

65 Relating Safety Classification Levels to the CC 90 7 EXTENDING FAA CERTIFICATION TO AIRBORNE NETWORKS 93

71 Extending ARP 4754 Into Networked Environments 94 72 Extending DO-178B Into Networked Environments 96

8 CANDIDATE SAFETY AND SECURITY NETWORK SOLUTION 98

81 System Security Engineering Methodology 99 82 Applying the SSE Methodologies to Airborne Networks 102 83 Exemplar Airborne Network Architecture Solution 105

831 The VPN Encapsulation Method 108 832 Physical Security 114 833 Encapsulation Gateways 115 834 Packet Filter 116 835 Firewall 117 836 The ASBR Router 117

iv

837 High-Assurance LAN 118 838 Quality of Service 118 839 Air-to-Ground and Air-to-Air Communications 118

84 Network Management Extensions 119

9 ANSWERS TO THE PHASE 1 QUESTIONS 122

91 Connection of Multiple Domains 122

92 Integrated Modular Avionics Implementation 123

93 Using Public IPs 125

94 Electronic Flight Bags 125

95 Updating Security Protection Software 127

96 Responding to Security Breaches 128

97 Access to Aircraft Data 129

98 Adequacy of Existing Regulations 129

99 Ground-to-Air Communication 130

910 What is the Efficacy of Cyclic Redundancy Checks With Respect to Security 130

10 ANSWERS TO THE PHASE 2 QUESTIONS 131

101 Are Current Regulations Adequate to Address Security Concern 131

102 How Does Security Assurance Fit Into Overall Certification Process 132

103 What Should Network Security Assurance Process Contain to Meet XX1309 132

104 How Will Continued Airworthiness and Maintenance be Addressed 134

105 How Can it be Ensured That Networked Systems Cannot Impact Safety 135

106 What Should the Process be for Updating Security Protection Software 135

107 How can Security Breaches be Handled 136

11 SUMMARY 137

v

111 Findings and Recommendations 139 112 Topics Needing Further Study 147

12 REFERENCES 148

13 RELATED DOCUMENTATION 156

14 GLOSSARY 157

APPENDICES

AmdashHistoric Attack Mechanisms and Tools BmdashFAA LAN Survey Results

vi

LIST OF FIGURES

Figure Page 1 Notional Networked Aircraft Architecture 10 2 Generic Future Communication System Physical Architecture 11 3 Alternative Notional Aircraft Architecture 11 4 Both Target Architectures Have Similar Security Profiles 14 5 Three Different Software Certification Environments 16 6 The FAA Five Layers of System Protection 19 7 Network Threat Mission and Operational Impact 21 8 Airborne Network Threat Targets 21 9 Threat Agents in a Networked Environment 26 10 A Sample Deployment 30 11 Comparison Between the OSI and TCPIP Protocol Stacks 46 12 Transforming Islands of Communication Into a Single Logical Network Infrastructure 49 13 Internet Protocol Stack to Convey Legacy Protocols 50 14 Overlapping Defense-in-Depth IA Systems 53 15 Sample Defense-in-Depth Technologies 54 16 Control Life Cycle 55 17 The DoD COMSEC End-to-End Packet Flow (IPV4 Example) 56 18 Representation of how Aircraft may Function Within the GIG 57 19 Internet Protocol Topology Hierarchy 59 20 Interfaces Between Customer and Service Provider Networks 67 21 Example of VPN Encapsulation Using IPsec 68

vii

22 Customerrsquos L3VPN Protocol Stack Shown Within the Network 69 Service Providerrsquos Network 23 Historic PBN Framework 70 24 Code- and Document-Signing Process 76 25 Code- and Document-Signing Verification Process 76 26 Bell-LaPadula Confidentiality and Biba Integrety Models Compared 82 27 DO-178B Classifications Using Biba Integrity Model 89 28 Gap Analysis in the Alves-Foss et al Study 93 29 Security Engineering Process 100 30 Secure Generic Airborne Network Design (High-Level View) 106 31 How Design Addresses Network Risks 107 32 How Design Addresses Network Threats 108 33 Close-Up Detail of How Encapsulation is Accomplished 109 34 VPN Interconnecting Two Sites 110 35 Sample Airborne Network Management 120 36 Notional IMA Design (Example 1) 124 37 Notional IMA Design (Example 2) 124

viii

LIST OF TABLES Table Page 1 Internet Engineering Task Force Protocol Security Features

and Key Management Configuration 36 2 Comparison of Safety Levels to Security Classifications 86

ix

LIST OF ACRONYMS AND ABBREVIATIONS AC Advisory Circulars ACARS Aircraft Communications and Reporting System AFDX Avionics Full-Duplex Switched [Ethernet] AJ Anti-jamming ARP Aerospace Recommended Practice AS Autonomous system ASBR AS boundary router (alternatively AS Border Router) ATN Aeronautical Telecommunications Network BGP Border Gateway Protocol CA Certificate Authority CC Common criteria CE Customer edge CERT Computer Emergency Response Team CFDIU Central fault display information unit CIDR Classless interdomain routing CIM Common information model CIO Chief Information Officer CLNP Connectionless network protocol COMSEC Communications security CONOPS Concept of Operations CONS Connection-oriented network service COPS Common Open Policy Service COTS Commercial off-the-shelf CPU Central processing unit CRC Cyclic redundancy check DAA Designated approving authority DARPA Defense Advanced Research Projects Agency DEN Directory-enabled networking DHCP Dynamic host configuration protocol DMTF Distributed Management Task Force DNS Domain Name System DoD Department of Defense DoDI Department of Defense Instruction DoS Denial of service DSS Digital Signature Standard EAL Evaluation assurance level EFB Electronic flight bag EGP Exterior gateway protocol ESP Encapsulating security payload FAA Federal Aviation Administration FIPS Federal Information Processing Standard FTP File transfer protocol GIG Global information grid HAG High-assurance guard

x

xi

HMAC Hashed Message Authentication Code HTTP Hypertext transfer protocol IA Information assurance IATF Information Assurance Technical Framework ICMP Internet control message protocol IDS Intrusion detection system IETF Internet Engineering Task Force IGP Interior gateway protocol IMA Integrated modular avionics IP Internet protocol IPsec Internet protocol security IPSP Internet protocol security policy ISMS Integrated security model for SNMP ISP Internet service providers IS-IS Intermediate system to intermediate system IT Information technology L2VPN Layer 2 virtual private network L3VPN Layer 3 virtual private network LAN Local area network LDAPv3 Lightweight directory access protocol version 3 LLC Limited Liability Corporation LPILPD Low probability of interceptlow probability of detection MAC Mission assurance category MANET Mobile ad hoc networking MIB Management information base MIP Mobile Internet protocol MOSPF Multicast open shortest path first (protocol) MPLS Multiprotocol label switching MSLS Multiple single levels of security NAS National airspace system NAT Network address translator NEMO Network mobility NFS Network file system NIDS Network intrusion detection system NIST National Institute of Standards and Technology NMS Network management system NSA National Security Agency NTP Network time protocol OMT Onboard maintenance terminal OS Operating system OSI Open system interconnect OSPF Open shortest path first (protocol)

PBN Policy-based networking PC Personal computer PE Provider edge PEP Policy enforcement point PFS Perfect forward secrecy PIB Policy information base PIM-DM Protocol-independent multicast-dense mode PIM-SM Protocol-independent multicast-sparse mode PKI Public key infrastructure PPS Ports protocols and services QoS Quality of service RAM Random access memory RFC Request for comment (ie Publications of the IETF) RPC Remote procedure call RSA Rivest Shamir Addleman RTP Real-time protocol SA Security association SATS Small aircraft transportation system SBU Sensitive but unclassified SLA Service level agreement SMTP Simple mail transfer protocol SNMP Simple network management protocol SPD Security policy database SSE System security engineering SSH Secure shell (protocol) SWAP Size weight and power SYN Synchronous (bit) TCP Transmission control protocol TCSEC Trusted Computer System Evaluation Criteria TFTP Trivial file transfer protocol TLL Time to live TLS Transport layer security TP Transport layer protocol TSIG Secret key transaction authentication for DNS UDP User datagram protocol V Version VPN Virtual private network WAN Wide area network

xii

EXECUTIVE SUMMARY

This is the final report of a 2-year Federal Aviation Administration (FAA)-funded study to address security and safety issues associated with networked airborne local area networks This study consisted of two phases Phase 1 investigated the methodologies for identifying and mitigating potential security risks of onboard networks that could impact safety Phase 2 investigated techniques for mitigating security risks in the certification environment Current FAA safety assurance processes for airborne systems are based on Aerospace Recommended Practice (ARP) 4754 ARP 4761 and Advisory Circulars (AC) (eg AC 251309-1A and AC 231309-1C) FAA software assurance is based on compliance with DO-178B that guides software development processes Complex electronic hardware design assurance is based on RTCADO-254 ARP 4754 extends the DO-178B software assurance process to address the additional safety issues that arise when software is embedded into highly integrated or complex airborne system relationships Connecting airborne software within network systems represents an extension of the ARP 4754 environment to networked items that share limited common functional relationships with each other This is because networks connect entities or components of a system into a common networked system regardless of the original functional intent of the system design (eg multiple aircraft domains can be connected by a common network system) Networks are inherently hostile environments because every network user including both devices (and their software) and humans is a potential threat to that environment Networked entities form a fate-sharing relationship with each other because any compromised network entity can theoretically be used to attack other networked entities or their shared network environment Networked environments and the entities that comprise them need to be protected from three specific classes of threat agents (1) the corrupted or careless insider (2) the hostile outsider and (3) client-side attacks Because of these dangers ARP 4754 needs to be extended for networked environments by ensuring network security protection and functioncomponent availability and integrity This in turn implies the need to strategically deploy information assurance security controls within network airborne systems Safety and security have therefore become intertwined concepts within networked airborne environments Security engineering addresses the potential for failure of security controls caused by malicious actions or other means Safety analysis focuses on the effects of failure modes The two concepts (safety and security) are therefore directly related through failure effects A shortcoming of either a safety process or a security process may cause a failure in a respective system safety or security mechanism with possible safety consequences to the aircraft depending on the specific consequence of that failure Previous studies have sought to address airborne safety and security by correlating DO-178B safety processes with common criteria security processes This correlation produces necessary but inadequate results It is inadequate because it lacks mathematical rigor and therefore produces ad hoc conclusions The results are ad hoc because even when safety and security are correlated they are nevertheless distinct concepts from each other addressing very different concerns

xiii

xiv

This report states that the primary issue impacting network airborne system safety is how to extend existing ARP 4574 ARP 4761 DO-178B and DO-254 assurance guidance processes into networked systems and environments in a mathematically viable manner This study recommends that these processes can be extended into arbitrarily vast network environments in a mathematically viable manner by using the Biba Integrity Model framework This report maps current DO-178B and ARP 4754 processes into the Biba Integrity Model framework using well- established system security engineering processes to define airborne safety requirements It applies best current information assurance techniques upon those airborne safety requirements to create a generic airborne network architecture Since the Biba Integrity Model is an integrity framework it carries within itself a natural mechanism for relating safety and security concepts in terms of their respective integrity attributes Nevertheless this study recommends that the model be implemented solely within the context of existing FAA safety processes This results in airborne network systems being organized into networks that operate at specific safety levels (the DO-178B software levels) There are fortuitous secondary effects from using the Biba Integrity Model to extend current FAA processes into networked environments that stem from it being the direct analog of the Bell-LaPadula Confidentiality Model The Bell-LaPadula Confidentiality Model forms the framework for confidentiality within US Department of Defense (DoD) information processing Consequently the application of the Biba Integrity Model to airborne system assurance processes results in an airborne network architecture that remarkably resembles the emerging DoD network architecture (the global information grid (GIG)) despite their very different underlying goals Consequently the generic airborne network architecture identified by this study greatly resembles the DoDrsquos GIG architecture While military technologies could be used to implement the airborne network architecture this study recommends the use of civilian Internet protocols deployed as a virtual private network In addition the similarities between the Biba Integrity Model and the Bell-LaPadula Confidentiality Models may result in increased synergies between the DoD and FAA certification processes Deploying airborne systems into networked environments means that the FAA system safety assessment (ARP 4761) system development (ARP 4754) software assurance (DO-178B) and complex electronic hardware assurance (DO-254) processes need to be extended to address and mitigate network threats For example although security is primarily a systems concept involving system issues (eg ARP 4754) the Biba Integrity Model relies upon the networked items having integrity attributes that function at a known assurance level (ie specific DO-178B software levels) This means that the processes for developing those items for network environments should be extended to address network attack risks The concept of high-assurance software in networked environments should therefore mean that items and systems will behave in the same manner before during and after network attacks ie be immune to potential network-based threats Exploits in network environments leverage latent software blemishes so that software items are subject to misbehavior corruption or compromise possibly including

use as a launching pad to attack other systems and items Current DO-178B processes do not currently include mechanisms to identify and fix well-known network attack vectors This study identifies specific additional tests to perform that function Unfortunately software testing alone cannot result in high-assurance software This is because tests only identify the flaws for which the tests are designed to identifymdashthey cannot warrantee the absence of other flaws that were not addressed by the test suite There is no existing security theory or process that can be leveraged to produce guaranteed high-assurance results for networked environments This is a very significant certification issue Until a solution for this problem is found this study recommends that the FAA ensure that high-assurance software complies with formal models and undergoes a rigorous line-by-line code inspection to demonstrate a lack of bugs that can be hostilely attacked

xvxvi

1 INTRODUCTION

This is the final report of a 2-year Federal Aviation Administration (FAA)-funded study to address security and safety issues associated with networked airborne local area networks (LAN) This study consisted of two phases Phase 1 investigated the methodologies for identifying and mitigating potential security risks of onboard networks that could impact safety Phase 2 investigated techniques for mitigating security risks in the certification environment Individual systems onboard aircraft are designed to meet specific operational functional and physical requirements The safety requirements of a flight-critical avionics system differ from a cabin management system or a passenger in-flight Internet service If these systems become interconnected incompatibilities in design assumptions administrative policies user interaction and data security considerations increase their exposure to risk Actions taken in the context of an open passenger network (whether originating onboard an airplane or from some remote site via a network connection) must be prevented from introducing flight-safety risks to flight-critical systems Airborne systems are designed built and approved in accordance with airworthiness requirements Current FAA safety assurance processes for airborne systems are based upon Aerospace Recommended Practice (ARP) 4754 [1] ARP 4761 [2] and Advisory Circulars (AC) eg AC 231309-1C [3] and AC 251309-1A [4] FAA software assurance is based on compliance with RTCADO-178B [5] that guides software development processes Complex electronic hardware design assurance is based on RTCADO-254 [6] The primary FAA certification standards are the respective regulations FAA policy and the ACs This study addresses how to extend current FAA processes and certification environment to include networked airborne LANs in a mathematically viable manner Because of the extensive scope of the current FAA policies and processes this report addresses this larger issue by specifically explaining how to extend the software assurance subset Other aspects of FAA policy and processes can be extended into networked environments in a parallel manner (ie by leveraging a security model framework see section 62) DO-178B is one means to secure approval of airborne software The system safety assessment processes (ARP 4754 and ARP 4761) determine failure conditions of the system and define safety-related requirements as input to the software life cycle processes DO-178B identifies the software level of a software item based on the potential contribution of the software to failure conditions for the entity in question Software level refers to the worst-case result of a failure of that software upon aircraft safety in terms of one of five possible failure condition categories The failure condition categories range from failure conditions that would prevent the aircraftrsquos continued safe flight and landing (catastrophic) to failure conditions that do not affect the operational capability of the aircraft nor increase crewrsquos workload (no effect) Higher software levels and greater assurance protections are provided to entities that would have higher safety consequences should they fail DO-178B also addresses some software design and certification considerations for user-modifiable software option-selectable software commercial off-the-shelf (COTS) software and other software-related issues

1

Similar guidance is also provided for airborne electronic hardware (eg DO-254) The principals that pertain to networking airborne systems that are addressed in this report directly pertain to all networked system entities both software and hardware This reportrsquos resulting exemplar network architecture (see section 83) is therefore agnostic concerning whether the airborne networked entities are hardware software or a combination of both Historically many software entities onboard aircraft are embedded in systems performing specialized mission-related functions COTS-generic computing devices are increasingly being deployed within the National Airspace System (NAS) and they are occasionally deployed within aircraft as well1 John Knight [7] identifies two primary reasons for the increased use of general-purpose computing devices and hardware (eg microprocessors random access memory (RAM) and memory management unit) 1 For enhanced avionics functionality Specifically entirely new concepts become

possible with the introduction of digital systems These include modern autopilot technology with greater functionality and flexibility than was possible with historic analog systems modern full authority digital engine controls envelope protection systems and flight deck automation (ldquoglass cockpitrdquo)

2 For enhanced safety Examples include aircraft condition analysis and management

systems structural health monitoring and automatic alerts of potential runway incursions

DO-178B and supporting advisory circulars address all phases of the software development process for all software types to ensure that airborne systems are safe This includes electronic flight bag computing devices [8] These cumulative systems processes and guidelines were historically targeted for aircraft environments whose internal networks are specialized to accomplish specific mission functionality Aircraft devices are historically connected via specialized and sometimes proprietary data buses to other devices with which they perform associated functions The nature of these connections is tailored to support their specific communication requirements (eg deterministic real time asynchronous etc) Air-to-ground communication similarly occurs via special-purpose communication systems using special-purpose data communication protocols Visionaries anticipate forces that could motivate future airborne system designs to replace todayrsquos diverse data bus systems within aircraft including many of their current constraints (eg access point limitations proprietary protocols labeling and mitigations such as cyclic redundancy checks) with airplane-appropriate LAN technologies that support standard Internet

1 COTS software components are very rare critical airborne systems and are discouraged from being deployed in

those environments because they cannot comply with DO-178B and other software policy in general

2

protocol (IP)-based communications For example reference 9 concluded that Ethernet-based LANs could be appropriate to serve as aviation data buses if they use

ldquoa switched Ethernet topology along with traffic regulation bandwidth restriction (guarantee and control of bandwidth allocation) and call admission controlrdquo

Coupled with the linkage of aircraft systems via a common network system is a growing perception of the desirability to improve and enhance air-to-ground and air-to-air communication systems and processes as well as to more closely integrate airborne systems with NAS systems For example bull Integrating multiple data bus systems into onboard LAN(s) is expected to reduce aircraft

size weight and power (SWAP) overheads thereby improving aircraft flight performance parameters

bull Next generation aircraft display systems may want to combine map and air traffic data

terrain information weather radar returns information on man-made obstacles and imagery on the airport environment This would require fusing data from sources that are not currently associated together It would also necessitate the support of high-bandwidth data communications internally within the aircraft as well as air-to-ground and within the NAS

bull National Aeronautics and Space Administration Small Aircraft Transportation System

(SATS) is investigating mechanisms that would enable small aircraft to fly to and from the 5400 small airports that are not currently being used for reliable public transportation ldquoA key to implanting SATS is a robust and extremely reliable automated communications system The system must be capable of passing large amounts of data between aircraft and ground systems as well as between neighboring aircraft in a reliable mannerrdquo [10]

bull George Donohue former FAA Associate Administrator of Research and Acquisition has

expressed concerns that the United Statesrsquo

ldquoair transportation network is seriously overloaded in the major cities that support airline hub operations hellip This hellip is leading to a gradual decrease in the US air transportation system safety hellip There is a growing consensus over the last 3 years that the capacity of the US National Airspace System is finite and currently approaching critical saturation limits hellip Without new technology and operational procedures we cannot increase capacity without decreasing the systems safety hellip Without increased capacity the increased cost of air transportation will effectively suppress demand (for new aircraft domestic tourism international travel etc) and have a profound effect on the nationrsquos culture and economy hellip System maximum capacity is very sensitive to aircraft final approach spacing Decreasing aircraft separation in the final approach to a runway from an average of 4 nautical miles between aircraft to 3 nautical miles

3

would increase this capacity in the USA [from the current 30 million operations per year] to over 40 million operations per year hellip [To accomplish this] all commercial aircraft will need to have double to triple redundant collision detection and avoidance systems on the aircraft with professionally trained pilots providing safe aircraft separation The national air traffic control system should be distributed between ground and airborne systems in such a way that it will be almost immune to single point failureshelliprdquo [11]

bull Arguments that the air traffic management system should become network centric to

ultimately achieve the NAS goals Dennis Buede John Farr Robert Powell and Dinesh Verma define a network centric-system as

- ldquoA network of knowledgeable nodes shares a common operating picture

and cooperates in a shared common environment - Functional nodes reside in the cognitive physical and information

domains and communicate with each other and between domains - The heart of the system is the network Knowledgeable nodes may act

autonomously (self-synchronization) with or without a central command and control facility The US Federal Aviation Administration (FAA) refers to the National Airspace System (NAS) which is made up of more than 18300 airports 21 air route traffic control centers (ARTCC) 197 terminal radar approach control (TRACON) facilities over 460 airport traffic control towers (ATCT) 75 flight service stations and approximately 4500 air navigation facilities The airlines and government employ more than 616000 active pilots operating over 280000 commercial regional general aviation and military aircraft hellip

hellip The current improvements to the NAS focus on safety accessibility flexibility predictability capacity efficiency and securityrdquo [12]

bull Evolving airborne software systems to similarly support network centric operations promises enhanced automated aircraft system update procedures and maintenance processes that are not possible with todayrsquos federated systems

The proposed transformation of todayrsquos aircraft and airspace system can be compared to the rapid increase in interoperability seen in commercial and military systems These previous revolutions similarly capitalized on explosive increases in computing power and interconnectivity as well as rapidly evolving protocols and services This rapid rate of change combined with a lack of discipline among commercial vendors who prized functionality over security unfortunately has resulted in a landscape where secure interconnected systems rarely (if ever) exist The anticipated deployment of networked LANs in aircraft is therefore not an isolated event It is a constituent element within the larger network centric evolution of society The implications

4

of linking aircraft-resident systems over a common data bus needs to be considered within the larger context of the network-centric evolution of air-to-air air-to-ground and ground-to-ground communications within the airspace as a whole However with these advantages come risks associated with increased exposure of previously isolated components Aircraft vendors operators and regulators need to understand the impact that interconnected systems may have upon flight safety Design test validation and verification techniques should consider the impact of unanticipated interactions between previously isolated systems In addition the effects of intentional failures caused by malicious software or persons need to be considered Existing evaluation techniques where individual systems have been evaluated in isolation should be updated to address safety concerns introduced by future interconnected systems FAA Order 137082 ldquoInformation Systems Security Programrdquo requires ldquothe FAA must ensure that all information systems are protected from threats to integrity availability and confidentialityrdquo [13] Section 41 of this report explains that networks potentially expose software to larger populations of attack threats As John Knight explains ldquounless a system is entirely self contained any external digital interface represents an opportunity for an adversary to attack the systemrdquo [7] Section 44 explains that COTS computing devices when deployed within networked environments have an indeterminate number of latent security vulnerabilities that can be attacked and potentially exploited COTS systems therefore have very questionable assurance characteristics in networked environments Even though aircraft may not deploy COTS software within their airborne LANs they nevertheless can benefit from the extensive experience gained to date from deploying COTS systems within networks and they may communicate with ground-based networks that widely deploy COTS systems Airborne software and devices unless they have been specifically assured for use in networked environments may or may not manifest similar problems depending on the number and type of bugs present in networked airborne software This is because latent security vulnerabilities when combined with the increased exposure of networked systems can result in security problems that have direct safety implications Vulnerabilities include bull Modification or replacement of authentic aviation software by an alternative variant

introduced by an attacker For example if an attacker could thwart onboard security procedures to download corrupted software of their own choosing then a safety hazard can arise if that corrupted software for example causes the pilotsmdashand the navigation systems they rely uponmdashto believe that their current altitude is 2000 feet higher than it actually is

bull Attacks to network system elements that either hinder correct software operation or else

modify the reported results of correct software operation For example if an attacker takes control of an onboard device and uses it to continuously flood the onboard network with spurious transmissions a safety hazard may arise should that denial of service attack on the network actually succeed in disrupting latency-sensitive real-time transmissions between distributed avionics components and by so doing induce incorrect computation results that affect critical onboard systems

5

Protections against these types of safety threats are primarily accomplished by means of deploying effective information assurance (IA) security controls Safety and security have therefore become intertwined concepts within networked airborne environments Security engineering addresses the potential for failure of security controls caused by malicious actions or other means Safety analysis focuses on the affects of failure modes The two concepts (safety and security) are therefore directly related through failure effects A shortcoming of either a safety process or a security process may cause a failure in a respective safety or security mechanism with possible safety consequences to the aircraft depending on the specific consequence of that failure This study deals with the security and safety issues and acceptance criteria of networked LANs in aircraft In view of the discussion above this study cannot merely evaluate the safety and security implications of introducing LANs to aircraft in an isolated manner Rather the system-wide consequences associated with these changes must be evaluated At a minimum this comprises two distinct but related concepts bull The security and safety issues including acceptance criteria of linking aircraft-resident

systems upon a common network infrastructure This common data bus causes those systems to no longer be physically isolated from each other Rather it links them into a common communications system A direct consequence of this change is that formerly isolated onboard software systems have become theoretically accessible via a common onboard communications system This common onboard communication system is also connected to the aircraftrsquos air-to-ground communication system

bull As described in the bullets shown on pages 3 and 4 anticipated network-centric changes

to the NAS itself results in NAS systems being increasingly redefined into network-centric systems This includes the possibility of aircraft systems being accessible from expanding regions of the NAS Should the NAS itself become connected to public data communications systems such as the Internet then this would result in the theoretical possibility of aircraft being accessible from systems outside of the NAS Specifically should the NAS become connected to the Internet the theoretical possibility exists of accessing aircraft from any location worldwide

By combining these two concepts the net result is the theoretical possibility that specific aircraft-resident systems may become accessible from any location worldwide This possibility has potentially severe safety assurance implications However similar risks result even when no entities using aircraft LANs are involved in communications with entities outside of the aircraft This is because attackers do not need to access aircraft-resident systems to launch electronic attacks upon aircraftmdashsimilar affects can be achieved solely by attacking ground-resident NAS elements For example

ldquoOne of the most frightening images of cyber terrorism is a scenario in which terrorists take over the air traffic control system and cause an aircraft to crash or two planes to collide in flight

6

Industry and governments are extremely sensitive even to the appearance of threats and vulnerabilities A collapse of public confidence in civil aviation safety and a failure to manage public expectation may have serious and widespread economic and social consequencesrdquo [14]

These affects may be similar to the events following the terrorist attacks on September 11 2001 Ken Birman has noted that parallel network-centric evolutions are widespread throughout our society He warns that

ldquoWersquore poised to put air-traffic control banking military command-and-control electronic medical records and other vital systems into the hands of a profoundly insecure untrustworthy platform cobbled together from complex legacy software componentsrdquo [15]

The potential scale of harm from a successful electronic attack against elements within a network-centric NAS system including network-connected aircraft is huge Adversaries may be anonymous and range from individual recreational hackers to well-financed criminal enterprises to well-organized state-led initiatives To the extent that the NAS builds upon COTS technologies the technology employed for electronic attacks will be simple cheap and widely available Reliance upon advances in COTS technology creates an extremely fluid threat environment as historic security vulnerabilities are addressed and new vulnerabilities discovered [16] Fortunately lessons from industry (civilian) and military security processes and experience can be applied to the aviation industry This report therefore examines the safety and security issues introduced by networked LANs on aircraft It seeks to adapt industryrsquos best system security engineering (SSE) practices to identify safety risks caused by aircraft networks It identifies potential security threats and assesses evaluation criteria It leverages best current industry and military practices It proposes specific extensions to ARP 4751 and DO-178B processes to address network security threats and certification issues that arise from networking airborne systems 2 OBJECTIVES AND APPROACH

The purpose of this report is to document evaluation criteria that can be used by certification authorities and industry to ensure that onboard networks will not negatively impact aircraft safety The results will be used by the FAA as input for development of policy guidance and regulations This work is divided into two phases The first phase focused on the potential security risks of onboard networks that affect safety and explored issues and solutions to critical questions raised by the aviation industry as manufacturers consider using LANs in aircraft Initial acceptance criteria for certifying aircraft that use LANs is provided to help evaluators understand the safety and security issues and specific evidence needed to show that proposed designs and countermeasures are sufficient to ensure safety of flight

7

This document also includes the studyrsquos phase 2 effort The phase 2 effort refines the phase 1 results to create specific recommendations to certifiers for the evaluation of the security and safety posture of airplane architectures which include both onboard and offboard networking capabilities Phase 2 also attempts to complete the acceptance criteria started in phase 1 It provides guidelines to help evaluators understand the safety and security issues with networks on airplanes and recommends specific evidence needed to ensure that proposed designs and countermeasures are sufficient to ensure safety of flight This report seeks to answer questions raised by the potential use of LANs on aircraft including bull Are current regulations adequate to address networked airborne security concerns bull How does security assurance fit into the overall certification process including ties to

safety assessment bull What should a network security assurance process contain to enable onboard networks to

meet Title 14 Code of Federal Aviation Part XX1309 [Where XX refers to the particular CFR Part (Parts 23 25 27 29 or 33)]

bull How will continued airworthiness be addressed for onboard networks and how will

regular maintenance be performed in the certification environment bull How can it be ensured that the systems connected to the onboard network cannot

negatively impact safety bull What should the process be for updating security protection software bull How can security breaches be handled Consequently this project bull investigates safety and security issues introduced by using LANs on aircraft bull investigates the potential security risks of an onboard network that could impact safety bull investigates the means for mitigating the security risks in the certification environment bull provides recommendations for assessing safety effects caused by potential security

failures bull provides recommendations for certification of LANs on aircraft

8

21 NOTIONAL NETWORKED AIRCRAFT ARCHITECTURE

Networking aircraft with the NAS is symptomatic of larger societal changes that are arising from the emergence of the worldwide Internet network of networks The Internet has had a profound impact upon many aspects of modern life Many businesses have redefined their relationships with other businesses increasingly basing them upon Internet-oriented electronic commerce technologies The public has also embraced the Internet as witnessed by the growing ubiquity of Internet services such as the worldwide web instant messaging and electronic mail within popular culture Perhaps because of this many aircraft manufacturers are planning to install onboard networks enabling passenger access to the Internet However if an aircraft manufacturer opts to have an onboard network that is available to both passengers and avionics equipment (ie a shared LAN) aircraft safety and security concerns arise As previously mentioned in the introduction parallel evolutionary changes to the NAS increasingly are being proposed that rely upon greater integration between air-based and ground-based airspace systems For example the operational integration of aircraft with the NASrsquo communication and logistics infrastructure promises dramatic improvements in operational efficiency Thus a variety of motivations are increasing the connectivity of aircraft systems to air-based and ground-based network infrastructures Current commercial aircraft systems and networks can be grouped in three major categories closed private and public The closed networks are representative of safety-critical avionics systems private systems represent airline operational systems cabin management systems etc open systems are represented by public Internet services offered to passengers Several changes have been proposed for next generation of aircraft due to the use of local area networking technologies In response to these proposed changes some projects have been initiated in which the common onboard network is designed with partitioning protections The assured robustness of the proposed partitioning is a concern from both a security and safety perspective Previous avionics systems have had their own data bus and have not been accessible by nonavionics systems Security has historically been enforced by a total lack of access (ie an air gap) between systems However as this paradigm changes to support common networked systems the safety and security aspects of the onboard network must be addressed by identifying the resulting risks and establishing appropriate controls to mitigate those risks Several notional views of the current and future aircraft networked systems have been formulated Figure 1 shows one of those views In figure 1 the current (existing) architecture is shown on the left side a logical picture of the proposed target architecture is in the middle and a list of changes to achieve the target (future) architecture is enumerated on the right As previously mentioned a key feature of the existing architecture is its air gap between airborne functions and passenger Internet services Thus there is no way a passenger or entities within

9

the worldwide Internet infrastructure can currently access airborne functions This proposed target architecture alternative by contrast has made three very significant modifications to the current airplane design bull It has created a network within the aircraft itself that supports communications using the

IP protocol family (see section 45) This implies that aircraft control entities logically share a common network infrastructure that is also connected to the nonessential IP network Consequently aircraft control entities are now theoretically connected to nonessential network entities

bull The passenger Internet services have now been connected to the nonessential IP network

This means that all entities within the aircraft will be theoretically connected within the same network system

bull The nonessential worldwide IP network is now connected to NAS and airline ground

systems and the Internet Specifically aircraft control elements are shown to be in the same network system that includes the NAS entities with which they may need to communicate as well as more than one billion people worldwide with Internet connectivity today

Aircraft Control

Airline GroundSystems amp Internet

Non-IP communicationinterface

IP communicationinterface

Existing

PassengerInternetServices

Airborne EquipmentAirborne Equipment

Aircraft Control(containing anIP Network)

Airline GroundSystems amp Internet

Floppy

Non-IP commun-ication interface

IP communicationinterface

Airline GroundSystems amp Internet

Aircraft Control(possibly containing

an IP Network)

Non-essential

IPnetwork

Non-essential

IPnetwork

PassengerInternetServices

Proposed Target

Primary differences in proposed target environment1 Aircraft shares a common

Internet protocol (IP)-based network system

2 Passenger Services AircraftControl and Airline InformationServices share a common network system

3 Specific Aircraft Control andAirline Information Services processes form distributed network relationships with NAS ground computers and potentially other aircraft

Difference1

Difference2

Difference3

Figure 1 Notional Networked Aircraft Architecture

The FAA (ACB-250) community has provided a generic future communication system physical architecture proposal taken directly from reference 17 and is shown in figure 2 which provides greater detail about the network links of the figure 1 target alternative

10

Controller

Aircraftoperator

ATC Voice

ATC Data

AOCAAC Data

Public Internet

Control Site

ControlSite

Equipment

MMC

Technicians

MMC

Technicians

Remote Site

RemoteSite

Equipment

Avionics

Aircraft Pilots

Crew

Passengers

AvionicsAvionics

Aircraft Pilots

Crew

Passengers

Avionics

Aircraft Pilots

Crew

Passengers

AvionicsAvionics

Aircraft Pilots

Crew

Passengers

H

G

G

F

E

Other Control Sites

A

B

C

D

AAC = Airline Administration Communication ATC = Air Traffic Control

AOC = Airline Operational Communication MMC = Maintenance monitor and control

Figure 2 Generic Future Communication System Physical Architecture [17]

Advocates have identified undesirable security implications with the approach shown in figure 1 related to potentially exposing avionics systems to passenger devices and systems These advocates argue that the advantages achieved by removing the historic security air gap between avionics and passenger systems cannot justify the increased risk to avionic systems posed by that connectivity Consequently they have identified an alternative target architecture which is shown in figure 3

Primary differences in proposed target environment1 Aircraft Control and

Airline InformationServices share a common network system

2 Specific Aircraft Control andAirline Information Services processes form distributed network relationships with NAS ground computers byusing an IP-based air-to-groundlink

However the air gap between the Aircraft passengers and the avionics systems remains in tact

Aircraft Control

Airline GroundSystems amp Internet

Non-IP communicationinterface

IP communicationinterface

Existing

PassengerInternetServices

Airborne EquipmentAirborne Equipment

Aircraft Control(containing anIP Network)

Airline GroundSystems amp Internet

Floppy

Non-IP commun-ication interface

IP communicationinterface

Airline GroundSystems

Aircraft Control(possibly containing

an IP Network)

Non-essential

IPnetwork

Non-essential

IPnetwork

PassengerInternetServices

Proposed Target

Internet

Difference1

Difference2

Figure 3 Alternative Notional Aircraft Architecture

11

While there are strong motivations (see section 1) arguing for the migration indicated in either figure 1 or figure 3 to take place there are security and safety reasons for why the current airborne architecture should not change Specifically the existing system is safer and more secure than either of the target systems Section 4 explains some of the reasons why the proposed changes that form the target designs result in significantly more risk to aircraft A summary of these reasons include the following bull The larger the networked community of devices the larger the potential number of

threats to the entities within those networks due to (1) direct or indirect relationships between the networked entities themselves and (2) the increased possibility of hostile attackers being present within the system

bull Due to the emergence of client-side attacks and other threats the (human) end users of

networked resources are now an important part of that networkrsquos total security defense posture Aircraft have limited control over the computer and network behavior of their Internet-connected passengers NAS employees as well as aircraft crew members must be trained to ensure that their own computer behavior does not inadvertently enable attacks against the aircraft This has direct security implications to both the airborne systems themselves as well as to those networks with which the aircraft connects

bull Entities within networks that are directly or indirectly connected to the Internet may

possibly be accessible by attackers located elsewhere in the Internet despite the presence of intervening security firewalls This implies that more than one billion people may (theoretically) potentially have access to aircraft

bull The Internet has experienced many well-documented instances of hostile attacks

affecting the integrity of computers networked systems and the data and services they support

bull COTS computer systems have an indeterminate number of latent bugs that can be

attacked bull COTS computer systems cannot be adequately secured within large network

environments in general because their security controls cannot be trusted to perform as intended when attacked They represent possible footholds that attackers can compromise and use as a base from which to attack other networked entities

bull Security vulnerabilities including those stemming from deploying COTS devices or

systems can theoretically be mitigated However the viability of those mitigation approaches are themselves suspect to the extent that they rely upon COTS systems for their implementation This is because COTS software and systemsmdashand the functionality they supportmdashare not trustworthy when attacked

12

bull The security viability of current networked systems is partially a direct function of the network and system management (including configuration management) expertise of its administrative personnel

bull The protocols of the IP family can be secured but their cumulative underlying key management system is ad hoc and complexmdashwith direct configuration and management implications

bull The IP familyrsquos network management system including its underlying simple network

management protocol version 3 (SNMPv3) protocol has questionable security viability when used in network environments that have large numbers of devices built by many different vendors

bull Whenever different security administrations or technologies are joined together in a

cooperative manner (eg aircraft and ground systems) it is important and challenging to define the interfaces between the systems in such a way that a diminished security posture for the combined system as a whole does not result

This report describes assurance mechanisms to mitigate these threats However the mitigation system has one key missing element (see section 72) Until that element has been successfully addressed no networked system can currently be guaranteed to be as safe or as secure as the currently deployed non-networked airborne systems 22 WHY BOTH TARGET ALTERNATIVES HAVE SIMILAR SECURITY POSTURES

It was mentioned that the architecture in figure 3 is more secure than the architecture in figure 1 However both alternatives have similar security postures such that the same network solution which is described in section 83 addresses the security and safety requirements for both target alternatives Figure 4 shows that both target alternatives similarly expose onboard aircraft systems to possible attacks from the worldwide Internet infrastructure for the reasons explained in section 41 While the air gap between passenger and avionics equipment of figure 3 (see bottom of figure 4) protects avionics systems from being directly attacked intra-aircraft from the passenger network they are still theoretically exposed to remote passenger or Internet attack via the NAS

13

Aircraft

World wide Internet Infrastructure

Air Gap in Aircraft Alternative No Air Gap in Aircraft Alternative

ControSit

NAS Both target approaches are - based threatsexposed to Internet

Second approach is somewhatmore secure than the first buthas greater size weight andpower (SWAP) requirements

Risk mitigation controls are very similar for both targets

Both targets use the same proposed target network architecture design Aircraft

Worldwide Internet InfrastructureAir Gap physically separates passenger communications from avionicscrew communications

avionic

passengers

NAS

Figure 4 Both Target Architectures Have Similar Security Profiles

Consequently the primary advantage of the target approach shown in figure 3 versus the target approach shown in figure 1 is that the figure 3 approach enables the port 80 (ie hypertext transfer protocol (HTTP)) overt channel to be closed within the aircraftrsquos perimeter defense firewall (see section 835) thereby eliminating a vulnerability by which firewall protections can be circumvented There are also two helpful secondary affects of the figure 3 approach bull The packet filter design (see section 834) is simplified Passenger communications of

the figure 3 approach do not traverse avionics networks Consequently the avionics network of that approach does not require that the packet filter system protect it by enforcing quality of service (QoS) provisions upon passenger communications to ensure that those communications do not consume too much avionics LAN capacity Similarly the packet filter would no longer need to ensure that passengers cannot address the encapsulation gateways (see section 833) or the cockpit (pilot) network since there would be no connectivity to those systems However the figure 3 approach still requires that the packet filter be retained to ensure that the noncockpit crew network cannot send packets to the encapsulating gateways unless those crew systems could be provided with physical security guarantees that they are never accessible to passengers

bull The high-assurance LAN (see section 837) is similarly simplified because it no longer

must be deployed in a manner to ensure that the passenger network can only access other avionics systems by means of the packet filter Rather different physical LAN systems must be used by the passenger system and the rest of the aircraft

Consequently the figure 3 approach does not eliminate the need to deploy a packet filter within the aircraft but it does simplify what that packet filter system does However the figure 3

14

alternative requires that parallel (ie distinct) sets of onboard networks and wireless external communications systems be created one for passengers and one for the other aircraft systems The figure 3 approach therefore has a higher SWAP overhead than the figure 1 approach by requiring parallel internal (onboard LAN) and external network (radio satellite etc) connectivity without significantly improving the security profile for the aircraft itself 3 EXTENDING THE CURRENT FAA CERTIFICATION ENVIRONMENT

The purpose of this section is to provide an orientation for how this study recommends that the certification environment be extended to handle networked airborne LANs The specific theory rationale and process underlying this studyrsquos recommendations are explained in subsequent sections (ie sections 6 7 and 8) It was previously mentioned that current FAA and civil aviation safety assurance processes for airborne systems are based on ARP 4754 ARP 4761 and the ACs FAA software assurance is based on compliance with DO-178B and complex electronic hardware design assurance is based on DO-254 The primary FAA certification standards are the respective regulations FAA policy and the ACs This study addresses how to extend these processes and certification environment to include networked airborne LANs in a mathematically viable manner Because of the large scope of the current FAA policies and processes this report addresses this larger task by explaining how to specifically extend its airborne software assurance subset Figure 5 shows a simplified and abstracted view of the current FAA software assurance approval process It shows that airborne software is currently developed and approved primarily according to the guidance and processes described within DO-178B2 When individual software items are combined into integrated or complex systems then additional safety considerations apply which are documented in ARP 4754 These considerations address integration issues and system vulnerabilities that may arise from system dependencies ARP 4754 refers to each element within that system as being an item This same terminology is adopted by this study DO-178B builds upon system design concepts such as the AC 251309-1A fail safe design concepts one of which is integrity Both DO-178B and ARP 4754 (ie section 222 of DO-178B where it is called the ldquosoftware level definitionsrdquo and Table 3 of ARP 4754) rely upon the same five failure condition categories Indeed the same failure condition categories are consistently used within other civil aviation documents as well (eg Table 2-1 of DO-254 and Table 1 of ARP 4761) Different development processes are applied to items classified in different failure condition categories so that items classified in the more severe safety failure conditions are developed by more extensive processes that produce higher assurance results For software items this is reflected in the DO-178B software level definitions For this reason this report refers to DO-178B software levels as reflecting safety assurance levels

2 There are other applicable policies and guidance in addition to DO-178B that can also be applied Please recall

that this figure is a simplified abstraction

15

Stand-alone Software System

ComplexSoftware

ComplexSoftware

ComplexSoftware

1) Stand alone software systemFocuses on that software entity (DO-178B)

2) Integrated or Complex SystemsAddresses each software Item (DO-178B) as well as the potentially complex affects resulting from their integration together (ARP 4754)

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

LAN-AttachedSoftware

3) Networked Airborne LANsA complex system in which every entity in the same network (ie the LAN and whatever the LAN directly or indirectly connects to) is inadvertently integrated togetherregardless of the functional intent of the system design

Processes must now also address possible networkinteractions during (and resulting from) network attacks

Fate sharing any compromised network entity can theoretically be used to attack other networked entities or their shared network environment

Other connectedLANs andNetworks

Finite Number of Entities Concerned with effective integration techniques

Concerned with fate sharing in a hostile environmentArbitrarily Huge Number of Entities

Figure 5 Three Different Software Certification Environments

ARP 4754 is directly concerned with architectural considerations that pertain to highly integrated or complex airborne systems

ldquoSystem architectural features such as redundancy monitoring or partitioning may be used to eliminate or contain the degree to which an item contributes to a specific failure condition System architecture may reduce the complexity of the various items and their interfaces and thereby allow simplification or reduction of the necessary assurance activity If architectural means are employed in a manner that permits a lower assurance level for an item within the architecture substantiation of that architecture design should be carried out at the assurance level appropriate to the top-level hazard hellip It should be noted that architectural dissimilarity impacts both integrity and availability Since an increase in integrity may be associated with a reduction in availability and vice-versa the specific application should be analyzed from both perspectives to ensure its suitabilityrdquo (Quoted from Section 541 pages 25 and 26 of reference 1)

Because ARP 4754 addresses possible system vulnerabilities that derived from creating functional system relationships between items to a certain degree it can be characterized as being directly concerned with effective integration techniques between those system items It therefore presumes that the regulator can correctly identify the items that comprise a system as well as their mutual relationships together

16

Aircraft network security is a systems issue System development (ARP 4754) in conjunction with the system safety assessment process (ARP 4761) is responsible for defining network accesses vulnerabilities detection and protection requirements Some of the vulnerabilities will be mitigated by limiting and controlling access by using hardware and software capabilities Some identified vulnerabilities will be mitigated by monitoring and detection capabilities The security protection should be defined by the system and then by appropriate system requirements allocated to hardware software and hybrids This study assumes that best current IA practice will be followed including deployment of traditional IA security controls when appropriate After implementation these protections mitigations and monitoring will also likely be verified and validated at the system level as well Consequently aircraft network security is an ARP 4754 issue However approving networked systems in some ways should be recognized as being a significant extension to ARP 4754 Networked systems differ from the current ARP 4754 environment in several significant ways Networked elements are systems that include all of the networks and their constituent elements and users to which the network is directly or indirectly attached Networks are therefore arbitrarily huge and the many interrelationships of the system items are often too subtle to discern Networks are inherently complex systems in which every item in the network is inadvertently integrated regardless of whether those items share any common functional goal Approval of networked entities must now also address possible network interactions that occur during and result from network attacks The various networked elements potentially have a fate sharing relationship with each other because any compromised network entity theoretically can be used to attack other networked items or their shared network environment Therefore networked airborne LAN environments are inherently ldquohighly integrated or complex aircraft systemsrdquo with attributes that extend the complex relationships for which ARP 4754 was created Section 4 and appendix A will introduce some of the risks that characterize networked systems and underlie the following observations bull In networked environments ARP 4754 needs to be extended to consider each item within

the LAN to be integrated even if that item has no functional relationship with anything else For example

- If the LAN experiences a successful denial of service (DoS) attack then each

networked item in that LAN may potentially be unable to fulfill its function Therefore ARP 4754 must be extended in networked environments to ensure availability

- If an item in the LAN becomes hostilely compromised by an attacker then it

potentially can be used by that attacker to attack the network itself or other items on the LAN Therefore ARP 4754 must be extended in networked environments to address LAN and item integrity To ensure LAN and item integrity ARP 4754 needs to be extended to require verifiably secure software installation procedures as well as mechanisms to ensure the continued integrity of deployed items and systems

17

bull If airborne LANs are connected into networks then the cumulative network system has

similarly become integrated and existing safety processes need to become extended to each system and item within that larger networked system if they are to remain viable even if any component element within the larger system never itself becomes airborne

bull If the network has both device and human users then ARP 4754 must also become

extended to also pertain to humans Every human or device with access to that network is a potential threat to that network and may potentially initiate attacks against the network itself the LANs or subnetworks that comprise that network of the items located within that network If the network is directly or indirectly connected to the Internet then there are theoretically more than one billion humans with potential access to that airborne LANmdashdespite the presence of intermediate firewalls This means that mechanisms are needed within networked systems so that human behavior cannot deprecate historic DO-178B and ARP 4754 safety assurances

This study identifies mechanisms by which ARP 4754 can be extended to address networking requirements by strategically introducing integrity and availability security controls It does this by building upon a mathematically based security model that can extend ARP 4754 concepts into arbitrarily vast and complex network systems This study uses proven SSE processes to combine these concepts and controls into the exemplar network architecture (see section 8) This study is also similarly concerned with extending DO-178B so that highly assured software items within networked environments can be developed and assured to mitigate known network risks The concept of highly assured software in networked environments explicitly means that the software can be trusted to behave in the same fashion before during and after attacksmdashsomething that current DO-178B processes cannot ensure because they do not explicitly address network attack threats Consequently current DO-178B software in networked environments may behave in an indeterminate manner during or after attacks if latent bugs within the software itself are successfully attacked by exploits that violate its integrity Such software is a potential threat to its deployment environment It is potentially subject to misbehavior corruption or compromise potentially including becoming used as a launching pad to attack other systems and items This issue is addressed in section 72 This study does not provide suggestions for the process by which the FAA or the worldwide civil aviation community may choose to respond to these recommendations It may be that the relevant experts may conclude that the revision of ARP 4754 and DO-178B that this study presumes is an unacceptably long term or unreliable approach for ensuring that network security concerns are adequately addressed in a timely manner If so then it is conceivable that the FAA may decide to produce an airborne network system security assurance policy in the near term If this is done then if SAE and RTCAEUROCAE subsequently decide to address this issue in the future then that initial policy could be revised to reflect their proposal

18

4 NETWORK RISKS

This section specifically discusses network security issues that are directly relevant to airborne safety and security within networked environments Two papers authored by Daniel Mehan [18 and 19] the former FAA Chief Information Officer (CIO) provide an important context for the material discussed in this section These papers describe the cumulative processes needed to create a secure and safe NAS environment These processes are partially summarized in figure 6 The majority of the topics covered in this section directly focus on network system aspects of ldquoCyber Hardening of System and Network Elementsrdquo shown in figure 6 of a total protection system Many other aspects of NAS safety and security are not addressed within this section and are only briefly addressed by this study

PersonnelSecurity

PhysicalSecurity

Cyber Hardening ofSystem and Network Elements

Compartmentalization

RedundancyArch

itectu

re a

nd E

ngine

ering

Awareness and Execution

Figure 6 The FAA Five Layers of System Protection [18]

Reference 20 also provides very helpful concepts and background information for the aircraft network safety and security topics presented in this section and appendix A It is important to recognize that network threats are always evolving An indeterminate number of network threats exist These network threats can mutate quite rapidly For example the following is an example of a current network threat that did not exist the year before this study was written

ldquoFile encrypting Trojans are becoming so complex that security companies could soon be powerless to reverse their effects a new report from Kaspersky Lab said

19

The report notes the rapid evolution of the public key encryption used by one family of crypto malware Gpcode which went from using 56-bit to 660-bit RSA [encryption key] in a matter of weeks Commonly termed lsquoransomwarersquo Trojans that encrypt data files on a userrsquos [personal computer] PC before demanding a payment in return for supplying the key to unlock the files have come from nowhere in recent months to become a measurable problem At the time of its discovery in June [2006] Gpcodeag ndash which used a formidable 660-bit key ndash Kaspersky described the process required to decrypt such a key as equivalent to setting a 22 GHz PC to work for thirty yearsrdquo (Quoted from reference 21)

Defenses that require a response to each new threat instance as it appears are both expensive and of questionable efficacy The best mechanism to effectively constrain the impact of these threats over time is to create a very solid safety and security foundation for both the NAS and aircraft Figures 7 and 8 were created by David Robinson [22] to indicate the possible threat affects that can occur when networked aircraft becomes successfully attacked These types of threats cannot occur for aircraft whose aviation systems are not attached to network systems

ldquoThese new generation aircraft [eg B787 A370 A350 BY-1] will include a new aircraft data network design which will introduce new cyber security vulnerabilities to the aircraftrdquo [22]

Unless properly mitigated any networked aviation system is potentially subject to the following range of impacts should they be successfully attacked

20

General Threat

Identifiers Aircraft Data Network Threats

Aviation Infrastructure Mission and Operational

Impact FAILURE Safe state of the aircraft system could

be compromised in the event of a security penetration

Access to the flight controls by unauthorized individuals affecting safety

DENIAL Aircraft system resources exhausted due to denial of service attack system error malicious actions

Critical services disrupted by system overload or traffic jamming

Access Control

Individual other than an authorized user may gain access to the aircraft system via phantom controller masquerade or spoofing system error or an attack for malicious purposes

Unauthorized Access

Passive Attack

Snooping or eavesdropping compromising security (misdirection) Design Flaws may lead to back door access

Unauthorized corruption or destruction of data causing unsafe flight conditions

Figure 7 Network Threat Mission and Operational Impact [22]

Threat Targets Threat Effects

Aircraft Operation Serious degradation or loss of mission capability airline is not able to perform its primary function

Assets Major damage to airline assets Financial Major financial loss Human Serious or catastrophic physical harm to individuals Public Perception Total loss of confidence in air traffic by passengers

disclosure of security information

Figure 8 Airborne Network Threat Targets [22]

The subsequent sections describe technical mechanisms to mitigate these risks 41 DIFFERENT UNIVERSES STAND-ALONE VERSUS NETWORKED

It is commonly recognized that the safety and security assurance properties of stand-alone systems are much more easily ascertained than the assurance of systems within networked environments This difference is primarily due to the fact that the assurance of stand-alone entities is a function of the inherent design of that system itself These include the repertoire of issues currently considered by DO-178B such as hardware and software design input-output direct memory access interrupt and interrupt processing design and development process controls operating system (OS) issues and security modes The assurance of networked systems by contrast is a function of not only that systemrsquos own internal design and processes

21

but also the implications of the effects to its design and operation caused by the other elements within the total system as a whole As Joel Knight has observed

ldquoUnless a system is entirely self contained any external digital interface represents an opportunity for an adversary to attack the system It is not necessary for an adversary to have physical access Of necessity many systems will communicate by radio and digital radio links present significant opportunities for unauthorized accessrdquo [7]

A great many issues partially determine the susceptibility of any networked item to possible attacks bull To what extent is an entity manageable If it is manageable how secure is the identity

authentication authorization and access control processes imposed upon administrative personnel and processes (eg separation of duties with least privilege)

bull To what extent is the entity configurable If it is configurable what controls ensure that

it is configured correctly bull How confident (eg assurance level) is the designer certifier and designated approving

authority (DAA) that there is a total absence of latent software bugs that can be attacked by hostile attackers to create safety threatening affects

bull How impervious is the implementation to attacks originating from other devices

including how dependent is the implementation upon inherent network availability or security attributes

bull How dependent is the entity upon other distributed components Can their misbehavior

result in safety threatening scenarios bull What is the relative security and integrity assurance of the data communications

protocols and underlying network media (including networking devices) used within that network infrastructure

The potential interaction of these networked elements is complex The possible complexity of these interactions is a partial function of the number of elements within the total system and the number of possible interaction mechanisms Some possible interactions can be unintended and subtle For example a system can be assured as being safe in a controlled environment using DO-178B processes However is this assurance still viable if that system is transplanted into a highly networked environment where unforeseen processes may try to influence it in unanticipated ways Will a real-time system perform adequately in environments where it is continually being accessed by a rogue process Even if the rogue process fails all authentication and authorization attempts can it still consume enough central processing unit (CPU) or network capacity

22

resources so that the required real-time interactions of that system with its legitimate peers are detrimentally impacted A basic attribute of network environments is that risks to elements within that system increase in direct relationship to the networkrsquos population size The larger the community of networked devices the greater the possibility that at least one of those devices has been constructed with latent bugs that can be leveraged to compromise that device to directly or indirectly attack other parts of the system Also the larger the community of humans that can access elements within the total network system the greater the possibility that at least one of those humans will exploit bugs either intentionally (maliciously) or accidentally Hostile electronic attacks may be conducted by both the corrupted insider (eg insider threat) as well as by unauthorized personnel who have leveraged system or process blemishes to gain unauthorized (remote) entry into the system It can also occur by means of accidental mistakes made by authorized personnel Widely used COTS network equipment such as Internet technologies is more easily assembled into large network systems than less popular communications technologies For example the Aeronautical Telecommunications Network (ATN) which is used for air traffic management systems today is built using open system interconnect (OSI) protocols OSI protocols are rarely deployed today except within specialized niche environments Because of this it is comparatively difficult to link ATN systems with other networks to create large network communities IP systems by contrast are ubiquitously deployed today Because of this it is comparatively easy to link together IP-based systems with other networks to create large network environments A key point to recognize is that just because an IP-based system is not connected to a large network environment today does not mean that it cannot easily be connected into a large networked environment tomorrow perhaps inadvertently For example inadvertent exposure of allegedly stand-alone (ie physically isolated via an air gap) IP networks to remote Internet-based attacks have occurred many times in real life by means of inadequately secured modems located within those allegedly isolated networks Widely deployed public networks have larger populations of users than small private networks The more people within the networking community the greater the probability that one or more of them may pose an attack risk to the elements within the system The larger the cumulative number of users within any aspect of the network the greater the possibility is that a user may purposefully or accidentally exploit those weaknesses in a detrimental manner The inclusion of the words ldquoaspect of the networkrdquo in the previous sentence is a reference to a technical point that is partially explained within appendix A That point is that in large network-of-network systems such as the worldwide Internet network access control defenses are established between discrete network administrative entities by means of security firewalls [23] Firewall technologies have significantly improved over time Unfortunately so has the sophistication of attacks against them A class of exploits3 exist that may possibly circumvent the access control protections of firewall systems Should these attacks succeed then those attackers could access network systems where they are not authorized

3 eg fragmentation attacks time-based attacks HTTP-based (Port 80) attacks and other emerging exploits

23

Specifically most networks implement firewall policies that permit remote access into the autonomous systems (AS) they protect through a port 80 (ie HTTP) overt channel Consequently many sophisticated attacks explicitly leverage the policy weakness that enables this overt channel to penetrate firewall systems Only a small percentage of currently deployed networks today have closed port 80 Even when administrative policy permits this vulnerability to be closed the efficacy of correctly configured firewalls using the very best technology can be circumvented by client-side attacks (see section 42) or improper configuration of other system elements (eg modems) Also firewalls that are deployed in SWAP-constrained environments (eg aircraft) are often susceptible to a range of modern attacks (eg fragmentation attacks time-based attacks) because they may not contain the necessary resources (eg CPU or RAM) to handle those attack vectors Consequently firewall protections can potentially be circumvented Firewalls therefore need to be part of a larger defense-in-depth system (see section 51) which needs to provide redundant protections (eg virtual private networks (VPN) see section 56)) to supplement the firewall in case its protections are circumvented In view of this potential danger the number of people that can access a network should not be equated to the number of people that are authorized to access that network Rather it should be considered to be the total number of people that can access any part of the larger network system in which that network is a part This explicitly includes users that are solely authorized to access another network to which onersquos own network is only indirectly connected Consequently if airplanes are even indirectly connected to the Internet then theoretically there are over one billion people that can potentially access entities within that airplane 42 INTERNAL EXTERNAL AND CLIENT-SIDE ATTACKS

Because networked systems traditionally use perimeter defense mechanisms (security firewalls) to limit access to internal network resources a distinction has been created between insiders and outsiders An insider is an individual who is authenticated and authorized to use internal network resources regardless of whether or not they are physically located geographically in the same location as the networked resource Outsiders are not authorized to have such access A large percentage of security controls have historically been centered on repelling security attacks from outsiders This reflects the fact that insiders usually undergo scrutiny to obtain their authorizations However higher assurance environments need to consider the possible threats stemming from corrupted insiders (ie the insider threat) These environments need to deploy controls so that the activities of all authorized users inside the network are restricted in terms of separation of duties with least privilege Unfortunately an entirely new class of attack the client-side attack has become increasingly popular and dangerous Client-side attacks include inadvertent exposure to hostile e-mail attachments or accesses to malicious web pages containing executables or scripts that allow arbitrary code to run In both cases the attacker leverages latent security vulnerabilities within the userrsquos web browser or e-mail client

24

ldquoWith the rise of client-side attacks a flaw emerges in the old [security] model despite avoiding a direct connection to the outside users might still be attacked by the very services that theyrsquove requestedrdquo [24] ldquoA new attack vector has been created in which users are transformed into a platform to attack internal resources without their consent or even their awareness Users are no longer passive participants in the security model theyrsquove become the very service by which entrance is gained into the protected interior of the networkrdquo [16]

There are many published examples of successful client-side attacks including the following

ldquoThe Oregon Department of Revenue has been contacting some 2300 taxpayers this week to notify them that their names addresses or Social Security numbers may have been stolen by a Trojan horse program downloaded accidentally by a former worker who was surfing pornographic sites while at work in January [2006] An investigation by agency security personnel and the Oregon State Police found that the malicious program was designed to capture keystrokes on the former employeersquos computer hellip The employee was an entry-level worker who was assigned to enter taxpayer name and address changes as well as some social security numbers lsquoWe know that the information that the Trojan gathered up was transmitted outside of the agencyrsquo to an unrelated Web site The incident is still under investigationrdquo [25]

Therefore attacks against networked entities may occur from outsiders from corrupted insiders as well as from client-side attacks (see figure 9) The effect of outsider attacks is to emphasize perimeter defense protections (eg firewalls VPNs) The effect of corrupted insiders is that network security is no longer primarily a function of establishing adequate perimeter defense controls it now must also include viable access control within the network itself The effect of client-side attacks is that network security is no longer solely a function of the total control protections established on devices within the network It is now also reliant upon the appropriate activities of every human using those network resources While filtering services located at the perimeter defense firewalls can and do combat client-side attacks however new attacks are continually being devised that perimeter defense filtering systems must be updated to identify and eliminate Consequently there is often a vulnerability window between when a new attack type has been devised and when the protections against that new attack have been deployed For this reason defense against client-side attacks heavily relies upon end-user educationmdashand can be circumvented by end-user mistakes

25

bull Corrupted or Careless Insiderbull Are authorized to access the networkbull Eg NAS personnel aircraft personnel or passengers local systems

bull Hostile Outsiderbull Are not authorized to access the networkbull May be located on ldquothe Internetrdquo

bull Client-side Attacksbull Malicious software lurking in ldquoneutralrdquo environments (eg email web

sites other) bull The historic distinction between ldquodatardquo and ldquocoderdquo is vanishingbull NAS personnel aircraft personnel and aircraft passengers may be duped

into inadvertently executing and thereby introducing malicious software into the network

bull Network users therefore have become an integral element of a networkrsquos security defenses

Figure 9 Threat Agents in a Networked Environment

This topic will resume in section 44 when the implications of mixing embedded systems and generic OSs within the same network will be discussed Before that discussion can occur however it is first necessary to discuss the vulnerabilities that exist within a networked environment 43 COMMERICIAL OFF-THE-SHELF VULNERABILITIES IN A NETWORKED ENVIRONMENT

While this section specifically addresses well-known COTS vulnerabilities in networked environments similar problems may or may not exist within embedded avionics systems depending upon whether latent bugs exist within those systems that can be exploited by network attacks Lance Spitzner has gathered together the following statistics which provide partial evidence that the worldwide Internet infrastructure is a very dangerous place bull ldquoAt the end of the year 2000 the life expectancy of a default installation of Red

Hat 6 a commonly used version of Linux [a computer OS] was less than 72 hours

bull One of the fastest recorded times a honeypot [ie a device deployed in order to

study the behavior of electronic attackers] was compromised was 15 minutes This means that within 15 minutes of being connected to the Internet the system was found probed attacked and successfully exploited by an attacker The record for capturing a worm was under 90 seconds

26

bull During an 11-month period (April 2000-March 2001) there was a 100 percent increase in unique scans and an almost 900 percent increase in Intrusion Detection Alerts based on Snort [an Intrusion Detection utility]

bull In the beginning of 2002 a home network was scanned on average by 31 different

systems a dayrdquo [26] This list can be supplemented by many other data points including bull ldquoThe most virulent [computer] virus to date infected several million machines in

about 20 minuteshelliprdquo [15] bull ldquoWhen we put this [honeypot] machine online it was on average hit by a

potential security assault every 15 minutes None of these attacks were solicited merely putting the machine online was enough to attract them The fastest an attack struck was mere seconds and it was never longer than 15 minutes before the honeypot logged an attempt to subvert it hellip

bull At least once an hour on average the BBC honeypot was hit by an attack that

could leave an unprotected machine unusable or turn it into a platform for attacking other PCs hellip

bull By using carefully crafted packets of data attackers hope to make the PC run

commands that hand control of it to someone else Via this route many malicious hackers recruit machines for use in what is known as a botnet This is simply a large number of hijacked machines under the remote control of a malicious hackerrdquo [27]

bull ldquoIronPort recently published a report showing that Trojan horses and system

monitors ndash two of the most serious types of malware ndash infect one out of every 14 corporate PCs That means that in an organization of 1000 desktop PCs there is an average of 70 computers that represent a major security risk hellip Dwarfing Trojans and system monitors are less serious types of malware such as adware and tracking cookies which infect 48 and 77 of PCs respectivelyrdquo [28]

bull ldquoThe number of new [COTS] software security vulnerabilities identified by

security experts hackers and others during the first eight months of this year [2006] has already exceeded the total recorded for all of 2005 according to Internet Security Systems Vulnerabilities through September have reached 5300 leaping past the 5195 discovered for all of 2005 says Gunter Ollmann director of the X-Force research group at ISS lsquoEight hundred seventy-one were found to affect Microsoft operating systems while 701 vulnerabilities were only found to affect Unix operating systemrsquo Ollmann says But many vulnerabilities cross platform

27

boundaries to affect them all including Linux About 3219 vulnerabilities fall into that realm Ollmann notes ISS ranks vulnerabilities as critical high medium and low Of the 5300 vulnerabilities recorded for 2006 so far 04 percent were deemed critical (could be used to form a prolific automated worm) 166 percent were deemed high (could be exploited to gain control of the host running the software) 63 percent were medium (could be used to access files or escalate privileges) and 20 percent were low (vulnerabilities that leak information or would allow a denial-of-service attack) hellip lsquoOf the 5300 vulnerabilities hellip 876 percent could be exploited remotely 108 percent could be exploited from the local host only and 16 percent could be exploited remotely and localrsquordquo [29]

The Computer Emergency Response Team4 (CERT) coordination center keeps a monotonically increasing list of reported Internet-related security incidents dating from 1988 to 2003 inclusive5 These statistics show that there was more than a 100 percent increase in reported security incidents in 2001 increasing from 21756 in 2000 to 52658 in 2001 The most recent incidents were publicly disclosed in 2003 which had 137529 different reported security incidents As the CERT notes ldquoan incident may involve one site or hundreds (or even thousands) of sites Also some incidents may involve ongoing activity for long periods of timerdquo [30] The CERT ceased reporting the number of security incidents after 2003 because ldquoGiven the widespread use of automated attack tools attacks against Internet-connected systems have become so commonplace that counts of the numbers of incidents reported provide little information with regard to assessing the scope and impact of attacks Therefore as of 2004 we will no longer publish the number of incidents reportedrdquo [30] An example of an undisclosed incident occurring since 2003 is the following

ldquoChinese hackers launched a major attack on the UK Parliament earlier this month the governmentrsquos e-mail filtering company MessageLabs Ltd has confirmed The attack which occurred on Jan 2 [2006] attempted to exploit the Windows Metafile (WMF) vulnerability to hijack the PCs of more than 70 named individuals including researchers secretaries and members of Parliament (MP) themselves E-mails with an attachment that contained the WMF-exploiting Setabortproc Trojan horse were sent to staffers Anyone opening this attachment would have enabled attackers to browse files and possibly install a key logging program to

4 CERT see httpwwwcertorg 5 See httpwwwcertorgstatscert_statshtml

28